What is a Digital Signature Certificate?
A Digital Signature Certificate, usually shortened to DSC, goes to a named person once their identity has been checked. That person then uses it to sign documents electronically.
It runs for a fixed period, after which it is renewed or allowed to lapse. It can be issued to an individual personally, or with an organization recorded against it.
The certificate lives on a hardware cryptographic token. The signing key stays on that token and works only when the holder connects it and enters the PIN. The signature therefore ties to one person holding one device.
How DSC signing works through an API
A DSC API lets your application take part in the signing. Your system assembles the document and presents it to the signatory, who signs with their token. It then records the signature, and can check the certificate behind it before you accept the document.
The signatory still sets the pace, and signing does not get faster. The document, the signature and the certificate details land in one workflow instead of on somebody else's laptop. Your legal or secretarial team gets a trail it can follow.
Who holds the certificate
A DSC belongs to a named human being. Where a business signs, the holder is a person acting for it, usually a director or a company secretary. Before you rely on a signed document, you want to know who holds the certificate, which organization is recorded against it, and whether it is still valid.
Portals and counterparties differ in the certificate class and type they accept. Confirm the requirement before anyone buys one. A certificate bought for the wrong purpose becomes a delay discovered at the worst moment.
Where a DSC gets used
- Lending and NBFC: sanction letters and security documents signed by the officer holding the authority, plus the entity filings the business makes itself.
- Fintech and PSP: partner and enterprise merchant agreements executed by a named signatory, where a click-to-sign record will not be accepted.
- Insurance: corporate and statutory filings and vendor documents signed by the recorded role holder.
- Logistics and freight: customs and trade filings, and portal submissions that accept only a certificate-based signature.
- Staffing and payroll: employer filings for provident fund and employee insurance, signed by the signatory on record.
- Real estate and infrastructure: tender and procurement submissions from the bidding entity, where the portal requires this signature type.
How to sign a document with a DSC
The sequence is short, and building around it means nothing gets retyped:
- Finalize the document so nothing changes after signing.
- The signatory connects the token holding their certificate and enters the PIN.
- The certificate on that token applies the signature.
- You read and record the certificate details behind the signature.
- You store the signed file against the matter, filing or counterparty record.
When a DSC is the right instrument
A DSC fits when any of these is true:
- The same person signs repeatedly in a defined role.
- A portal or counterparty asks for a certificate-based signature.
- The document has to stand on the authority of a named officer.
It fits poorly for a customer who signs one agreement and never signs again. Those journeys suit the Aadhaar eSign and Electronic Sign services, each on its own page.
Handling DSC signing in your systems
Keep the finalized document unchanged once you present it for signature, and store the signed file exactly as it comes back. Re-rendering it can break verification.
Record the certificate details you relied on at signing, since a certificate valid today may have expired when someone re-examines the document. Track expiry dates for the signatories you depend on, because a certificate that lapses on a filing deadline is a predictable failure.
Which fields and checks you get depends on your service contract and on the data source behind the certificate.
Token custody and signing authority
A certificate and its token are personal to the holder. Do not share the PIN with a team, keep it in a shared vault or hand it to a vendor. Where your business needs signing without a person present, arrange that deliberately under the organization instead of lending somebody a token.
Record who signed what and on whose instruction, and remove signing authority when a role holder leaves. Hold certificate details and signed documents under the same retention and access rules as your other records.
Where the identity checks behind a certificate involve personal documents, follow the same consent and authorized-use rules you follow for any other identity data.