Applying for a Digital Signature Certificate
Chapter Six
Syllabus topic 2, "Application and Registration procedure of Digital Signature."
Pages 11 to 12 of 80
Who issues it
Section 35(1) of the Information Technology Act 2000:
Any person may make an application to the Certifying Authority for the issue of a electronic signature Certificate in such form as may be prescribed by the Central Government.
A Certifying Authority is a person licensed under section 21 to issue certificates. The licences are granted by the Controller of Certifying Authorities, appointed under section 17.
So the chain is: the Controller licenses the Certifying Authority; the Certifying Authority issues the certificate; a Registration Authority appointed by it does the verification. A student who says "the Government issues a DSC" is wrong, and the correction is worth a mark.
The fee
Section 35(2):
Every such application shall be accompanied by such fee not exceeding twenty-five thousand rupees as may be prescribed by the Central Government, to be paid to the Certifying Authority:
Provided that while prescribing fees under sub-section (2) different fees may be prescribed for different classes of applicants.
Rs. 25,000 is a ceiling on what may be prescribed, not the price. What a Class 3 certificate actually costs, with its token, is a small fraction of it, and the price differs between Certifying Authorities because they compete.
What accompanies the application
Section 35(3) requires a certification practice statement, or a statement of the prescribed particulars where there is none. That is the Certifying Authority's own published statement of how it verifies and issues, and it is a document about the Authority rather than about the applicant.
The decision
Section 35(4):
On receipt of an application under sub-section (1), the Certifying Authority may, after consideration of the certification practice statement or the other statement under sub-section (3) and after making such enquiries as it may deem fit, grant the electronic signature Certificate or for reasons to be recorded in writing, reject the application
and its proviso:
Provided that no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.
Three safeguards in one sub-section: reasons must be recorded, they must be in writing, and the applicant must be heard first.
The documents, by form of business
MU's scope note confines this paper to individuals and partnership firms, so those two are set out in full.
For a proprietor, applying in his own name.
| Document | Purpose |
|---|---|
| PAN card | Identity, and the number that goes into the certificate |
| Aadhaar, passport, driving licence or voter card | Identity |
| Aadhaar, passport, bank statement, or a utility bill not older than three months | Address |
| Passport size photograph | The application form |
| Email address and mobile number | Verification, and delivery of the certificate |
For a partnership firm, where the certificate is in the name of an authorised partner. Everything above for that partner, and in addition:
Applying for a Digital Signature Certificate
| Document | Purpose |
|---|---|
| PAN of the firm | The firm's identity |
| Partnership deed | To show the applicant is a partner and is authorised |
| Authorisation letter signed by the other partners | To show which partner may hold the certificate |
| Firm's bank statement or registration certificate | The firm's address |
| GST registration certificate, where the firm has one | Corroboration |
The certificate is issued to a person, never to a firm. A partnership firm cannot hold a Digital Signature Certificate of its own; a named partner holds one and signs for the firm. That is the commonest misunderstanding on this topic and the reason the authorisation letter exists.
The steps
- Choose a licensed Certifying Authority. The Controller publishes the list; eMudhra, Sify, NSDL, Capricorn and the National Informatics Centre are among them.
- Fill the application form, online or on paper, with the class and the validity wanted.
- Pay the fee.
- Complete verification. This is the step that changed: it is now normally Aadhaar-based e-KYC with a video recording, in which the applicant reads a displayed code aloud to camera. Where e-KYC is not used, the Registration Authority verifies documents in person and attests them.
- Approval by the Certifying Authority.
- Download the certificate into the token. The private key is generated inside the USB cryptographic token and never leaves it.
- Receive the token, or download onto a token already held.
Two to seven working days is normal where e-KYC is used, and longer where paper verification is needed.
What the applicant should check before paying
- That the Certifying Authority is on the Controller's licensed list. Section 21 makes an unlicensed issuer's certificate worthless.
- That the class is Class 3, which is the only class now issued.
- Whether encryption is needed as well as signing, because a combined certificate costs more and a tender usually requires it.
- The validity, one, two or three years, and that the expiry does not fall in the middle of a filing season.
- That the name and PAN on the application are exactly as on the PAN card. A mismatch is the commonest cause of rejection, and correcting it means applying again.
The rest of this subject
These notes are cut from the University's printed syllabus. Open the syllabus itself, or the past papers, for the same subject.