DSC renewal: how to renew a Class 3 digital signature and keep bidding

DSC renewal sounds like a quick top-up, but under the rules of the Controller of Certifying Authorities (CCA) it works like buying a fresh certificate: new verification, new key, new serial number. That matters to bidders, because every e-procurement portal treats the renewed DSC as a different certificate until you register it. This guide covers how to renew a Class 3 DSC, whether your USB token can be reused, and how to switch each portal over without missing a bid. For choosing your first DSC, see our DSC guide.

Can a DSC be renewed, or must it be reissued?

The CCA's X.509 Certificate Policy (version 1.10, July 2025) describes two options in principle:

• Renewal: a new certificate with the same name and the same key, but a new validity period and a new serial number.
• Re-key: a new certificate with a new key pair.

Neither is offered to subscribers today. The CCA's template for certification practice statements, which licensed CAs follow, says: "Requests for renewal of certificates are not accepted by CA at present due to the constraint present in the CCA-IVG". It adds that the CA "does not offer a certificate Re-Key option to subscribers". The published practice statements of eMudhra, Capricorn and (n)Code use the same words.

eMudhra's renewal page puts it in plain terms: "Renewal of Digital Signatures requires fresh identity verification", done by "following the same process as buying a new Digital Signature Certificate".

So the official position is that a DSC is reissued, not renewed. Two things follow:

1. You go through identity verification again.
2. Portals don't pick up the new certificate by themselves. You register it again on each one.

How to check your DSC expiry date

Your token's own software shows the dates. eMudhra's help page gives the route for common tokens:

1. Insert the token and open its token manager, the program installed with its driver (for example ePass2003 Token Manager, ProxKey for Watchdata tokens, the TrustKey tool or mToken CryptoID).
2. Log in with your token PIN if asked, select the certificate and click View certificate (or Show certificate).
3. Read the validity or expiry date in the certificate details.

If you don't check, the portals will tell you the hard way. On NIC portals, "If the enrolled DSC has expired, the system automatically inactivates the same and prompts for another DSC to be enrolled (afresh) at the next login."

Class 3 DSC renewal, step by step

1. Pick a licensed CA. The CCA lists 23 licensed CAs on cca.gov.in. Any CA on that list can issue your new certificate.
2. Choose the certificate. Class 3 is the only choice now: the CCA's identity verification guidelines bar CAs from issuing Class 2 individual signing certificates on their own. Then choose individual or organisational, signing only or signing + encryption, and one, two or three years. Keep the type your portals need: NIC bidders need only a signing certificate, while IREPS asks for a Class III DSC with your company name.
3. Verify your identity. Your CA keeps an "eKYC account" for you, built from Aadhaar, PAN, bank or organisational KYC. It lasts up to two years and can be extended only through fresh verification. For each new DSC, the guidelines require a video verification or an Aadhaar biometric authentication done within the last two days, and the CA matches your face against its records. An organisational DSC also needs authorisation from your organisation's authorised signatory.
4. Pay. The CCA's policy lets licensed CAs "set any reasonable certificate issuance and renewal fees". The CA must send you a GST tax invoice by email and SMS.
5. Download onto your token. The key pair is generated on the token with the CA's software. Download within 30 days of approval; after that, the CA must verify you again.
6. Register the new DSC on your portals. See the section below.

eMudhra DSC renewal: how one licensed CA does it

eMudhra is one of the licensed CAs on the CCA's list. Naming it here isn't a recommendation; every licensed CA follows the same CCA rules, so the steps elsewhere are similar. eMudhra's renewal page lists these steps:

1. Choose the user type: Individual or Organization.
2. Choose the certificate type: "Signature", or both signature and encryption.
3. Choose the validity (1, 2 or 3 years) and complete the purchase.
4. Verify your identity through its online, paperless process.
5. Download the certificate.

Its help pages say the paperless process takes about 10 to 15 minutes once your documents are in. Its renewal page suggests the signing + encryption combination for e-tendering. On NIC portals bidders need only signing, so check what your own portals ask for before you pay for more.

Can you reuse your old USB token?

Often, yes. The CCA's crypto device rules decide it:

A few more rules worth knowing:

• Check your CA's token list. Each CA must publish the approved token makers and models on its website.
• Change the default PIN. CAs can't download a DSC onto a token that still has its default password.
• Never format or "initialise" a token with old certificates you need. NIC's FAQ warns that initialising removes the certificates on it, and asks users never to delete old encryption certificates. Departments are advised to take the new DSC on a new token and keep the old one intact.
• Forgot your PIN? CAs don't reset token PINs unless the token is re-initialised. The CA then reissues your certificate for its remaining validity, free at least once per certificate.
• Locked out? Too many wrong PINs block the DSC. NIC's FAQ says to contact the CA that issued it.

Re-registering the new DSC on e-procurement portals

Each portal keeps its own record of your certificate, and a renewed DSC counts as a new one.

CPPP and NIC portals

This covers eprocure.gov.in (where central tenders listed on CPPP are bid), etenders.gov.in, defproc.gov.in and the state GePNIC portals. NIC's FAQ says your enrolment "is valid as long as your business exists", but "upon expiry of your DSC, you have to renew your DSC from the Certifying Authority and re-enroll the DSC".

• Old DSC still valid: log in with the old DSC, open DSC information on the dashboard and click remove. Log out, log in again, and the portal asks you to enrol the new DSC.
• Old DSC already expired: the portal inactivates it and asks for a new DSC at your next login.
• Allow a day. A newly issued DSC can take up to 24 hours to be recognised, so the FAQ asks you to register at least 24 hours ahead.
• Repeat on each portal. Only one DSC can be mapped to a login at a time, and each portal has its own enrolment.

The NIC bidder registration guide shows these screens step by step.

GeM

GeM's FAQ doesn't describe a DSC registration step. It lets you verify bid participation, contract acceptance and invoices by OTP, e-sign or digital signature. If you sign with a DSC, only Class 3 certificates work, and the emBridge application must be installed and running. If you use e-sign or OTP, your DSC renewal changes nothing on GeM. See GeM registration for how sellers verify.

IREPS

Indian Railways' IREPS asks for a "Class III Digital Signature Certificate with Company Name". Railway tender conditions say vendors "are required to re-register themselves with the www.ireps.gov.in web site whenever their DSC is renewed". The IREPS helpdesk page has a Request for Change of Digital Signing Certificate option, with one condition: the new DSC's name must match your user account. Renew an organisational DSC in exactly the same names.

State portals with their own systems

States that don't use NIC's software have their own steps. On Karnataka's KPPP, log in with the old DSC, open Profile → Manage Certificate and map the new one. KPPP turned on two-factor login from 2 May 2025 and asked suppliers to renew and map their DSCs. For other states, check the portal's DSC help page; the portals guide shows which states run their own systems.

When to renew: timing before bid deadlines

The renewal itself can be quick. Delays come from the steps around it:

• Verification: the video or Aadhaar biometric check must be within two days before issue, so book it close to when you'll download.
• Download: within 30 days of approval, or verification starts again.
• Activation: up to 24 hours on NIC portals, and a request to be processed on IREPS.
• Every portal: you repeat the switch on each portal you use.

A sensible routine:

1. Note your expiry date and start the renewal well before it, not after.
2. Don't switch DSCs in the last days before a closing date. Plan the switch for a quiet week.
3. Log in to each portal with the new DSC once it's mapped, to be sure it works before you need it.
4. Check the expiry against bid opening dates, as our DSC guide explains.

If you follow tenders on GovtTenderHub, look at the closing dates of those you plan to bid on before you pick a day to switch. New central tenders appear on CPPP tenders as they are published.

Common questions

Can I renew an expired DSC?

Yes. Because a renewal is a new certificate anyway, you apply the same way before or after expiry. The difference is the gap: until the new DSC is registered, NIC portals ask for a new DSC at login, so you can't carry on with bids.

How much does DSC renewal cost?

Each licensed CA sets its own price; the CCA's policy allows "any reasonable" issuance and renewal fees. There is no government fee. The CA must send you a GST tax invoice by email and SMS.

Do I need a new USB token for DSC renewal?

Not always. A newer token on your CA's approved list can take the new certificate. Tokens without the new unique serial number and no-PIN-reset design can't be used since 1 April 2023, and older FIPS 140-2 tokens with "historical" status lose fresh issuance after 21 September 2026.

How long does DSC renewal take?

The verification must be within two days before issue, and you have 30 days from approval to download. eMudhra says its paperless process takes about 10 to 15 minutes once documents are submitted. Add up to 24 hours for NIC portals to recognise the new DSC.

Can my CA's agent renew my DSC for me?

No. The CCA's guidelines don't allow a power of attorney, and the CA's eKYC interface takes details only from the applicant. You must do the video verification or Aadhaar biometric check yourself.

Can I renew my old Class 2 DSC?

Not as Class 2. CAs may no longer issue Class 2 individual signing certificates on their own, so your new certificate will be Class 3. That's the class e-procurement portals ask for anyway.