Getting set up
Digital signature (DSC) for e-tendering: which one you need
Which digital signature certificate you need for e-tenders: Class 3, signing vs encryption, personal vs organisation, validity, setup and common DSC errors.
By GovtTenderHub editorial teamUpdated 5 min read
On this page
In short
- To bid on NIC e-procurement portals (CPPP's eprocure.gov.in, state portals, CPSE, Defence) you need a Class 3 Digital Signature Certificate on a USB token. Class 2 certificates are no longer issued on their own.
- A signing certificate is enough for bidders on NIC portals. Encryption certificates are for the officials who open bids. Some other portals ask bidders for both, so check before you buy.
- The DSC is issued to a person, not a company: buy it in the name of the director, partner or proprietor who signs your bids. An "organisation" DSC also shows the firm's name.
- Certificates last one to three years. Buy from one of the licensed certifying authorities listed by the Controller of Certifying Authorities (CCA).
- Register the DSC on each portal at least a day before you need it: a new DSC can take up to 24 hours to work, and each account can have only one DSC.
A digital signature certificate is your pen on an e-tender. It proves the bid came from you and that nobody changed it after you signed. Without a working DSC you can't enrol on NIC portals or submit a bid, and a DSC that expires before bid opening can sink a bid you've already sent. This guide covers which certificate to buy, how to set it up, and the mistakes that cost bidders.
Which DSC you need
Class 3. The CCA's identity verification guidelines (version 2.6, June 2026) require certifying authorities to issue Class 3 individual signing certificates, and they may not issue Class 2 signing certificates on their own. If you still have an old Class 2 certificate, it won't do for e-tendering.
Signing, and maybe encryption. A DSC can hold two kinds of certificate:
| Certificate | What it does | Who needs it on NIC portals |
|---|---|---|
| Signing | Signs your bid, so it's legally yours and can't be altered unnoticed | Every bidder |
| Encryption | Decrypts bids that were encrypted for you | The department's bid openers |
On GePNIC, bids are encrypted to the bid openers' certificates, not the bidder's. The CPPP FAQ says it plainly: "Bidders require class 3 DSC with only Signing Certificate". Some non-NIC portals and some buyers ask bidders for an encryption certificate as well, sold as a "signing + encryption" combo. Check the DSC requirements of the portals you'll use before you buy.
Personal or organisation. DSCs are issued to individuals. An individual certificate carries just your details; an organisational one also names the firm you work for. For bidding, get it in the name of the person authorised to sign bids for your firm. A company doesn't get a DSC of its own.
How to get one
- Pick a licensed certifying authority (CA). The CCA publishes the current list at cca.gov.in; there are 23 licensed CAs, including eMudhra, Capricorn, (n)Code, Protean, Safescrypt, IDSign, Pantasign, XtraTrust and CDSL Ventures. Many sell through resellers. The CA must be on the CCA's list.
- Choose the certificate: Class 3, individual or organisation, signing only or signing + encryption, and validity of one, two or three years.
- Complete verification. Under the CCA guidelines, the CA checks your identity by online Aadhaar e-KYC or documents, plus a physical or video verification. For an organisational certificate you also provide proof of the organisation and your authorisation.
- Get the token. The key pair is generated on a FIPS 140-2 validated USB token, as the CCA requires. The private key can't be copied off it, so the token is your signature. Keep it safe.
Issuance usually takes a day or two once your documents are in order.
Setting it up on a portal
- Install the token driver from the token maker, and any signing utility the portal asks for. Each portal's "DSC" or help page lists what it needs.
- Enrol on the portal (Online Bidder Enrollment on NIC portals), then log in and map your DSC to the account.
- Wait for it to activate. The CPPP FAQ warns that a newly issued DSC can take up to 24 hours to be recognised, so register at least a day ahead.
Two rules to know on NIC portals:
- One DSC per account. Only one DSC can be mapped to a login ID at a time.
- One DSC, many portals. You can use the same DSC on other e-procurement portals; map it separately on each.
When you renew, map the new DSC to your account before the old one expires.
Do you need a DSC for GeM?
Usually not. GeM verifies sellers with Aadhaar or PAN and OTPs, and its terms provide for Aadhaar-based e-sign on documents, which the IT Act treats on par with a digital signature. See GeM registration.
Common DSC problems
- Token not detected: the driver isn't installed, or the browser can't reach the signing utility. Reinstall the driver and follow the portal's setup page.
- "Certificate not found" at login: the DSC mapped to your account is different from the one plugged in, often after a renewal.
- Expired certificate: the signature fails, or the bid can't be processed at opening.
- The signer has left the firm: the DSC is personal. Get one for the new authorised signatory and map it before the next bid.
- Encryption certificate deleted from the token: for department users this matters, because old encryption certificates are needed to open bids encrypted with them. The CPPP FAQ asks users never to delete them.
Common questions
What is the validity of a Class 3 DSC?
One, two or three years, as you choose when buying. The CCA's certificate policy allows up to three years for a signing certificate.
Can I use one DSC on several tender portals?
Yes. The same DSC can be used on other e-procurement portals, as long as you map it to your account on each one. On a single NIC portal, only one DSC can be mapped to an account at a time.
Is a DSC needed to download tender documents?
On NIC portals, tender lists and documents are public; you need a DSC to enrol, log in and submit bids. Logging in has one benefit: the portal emails you corrigenda for tenders you've marked.
Do I need an encryption certificate to bid?
Not on NIC GePNIC portals, where bidders need only a signing certificate. Some other portals ask for one, so check their DSC requirements.