Verified as on September 2026 against Information Technology Act 2000, Controller of Certifying Authorities (CCA) Guidelines and DGFT Common Digital Platform Specifications.
The Short Answer: What is a Digital Signature Certificate
A Digital Signature Certificate (DSC) is a secure digital key issued by licensed Certifying Authorities (CAs) under the regulatory supervision of the Controller of Certifying Authorities (CCA). Built on asymmetric cryptography using 2048-bit RSA key pairs, a DSC authenticates the identity of the signer, guarantees that document contents have not been altered in transit and establishes legal non-repudiation. For international trade, a Class 3 Organizational DSC is mandatory to submit IEC applications, execute Advance Authorisation and EPCG filings, register Authorised Dealer (AD) codes and sign customs shipping bills.
The rule that decides everything: For DGFT portal transactions, an individual personal DSC is invalid. Companies, LLPs, societies and partnership firms must use an Organizational Class 3 DSC where the cryptographic certificate embeds the authorized signatory’s personal PAN legally mapped to the enterprise Importer Exporter Code (IEC).
| Item Parameter | Statutory Provision |
|---|
| Certificate Standard | Class 3 Digital Signature Certificate (Signing or Combo Signing & Encryption) |
| Governing Framework | Information Technology Act 2000 (Sections 3, 35 and 43A) and CCA Interoperability Guidelines |
| Regulating Authority | Controller of Certifying Authorities (CCA), Ministry of Electronics and Information Technology |
| Who It Is For | Authorized signatories, corporate directors, partners, proprietors and customs brokers managing trade filings |
| Hardware Requirement | FIPS 140-2 Level 2 compliant cryptographic USB hardware token (ePass 2003, ProxKey, mToken) |
| Validity Options | 1 Year, 2 Years or 3 Years from issuance date (renewable via fresh video e-KYC verification) |
| Core Applications | DGFT portal filings, ICEGATE shipping bills, GST export refunds (RFD-01), MCA21 filings and e-Tenders |
Why We Are Writing This
More than 40% of technical helpdesk queries raised on the DGFT Common Digital Platform trace directly to cryptographic token errors: missing middleware drivers, blocked local WebSocket ports, unlinked director PAN records or trying to authenticate corporate files using personal certificates. Exporters frequently face critical shipment delays because a token expires unnoticed or becomes locked during an urgent customs filing.
Rasp International provides rapid hardware-bound Class 3 DSC issuance, driver configuration and portal mapping. Having guided over 500 exporters since 2005, our technical desk resolves emSigner port conflicts, integrates tokens with ICEGATE and ensures your business maintains continuous cryptographic authorization across all government gateways.
Technical Architecture: Class 3 DSC Specifications
Following the regulatory consolidation mandated by the Controller of Certifying Authorities, Class 1 and Class 2 certificates have been discontinued. Class 3 is the sole statutory standard for all legal and trade filings in India:
1. Cryptographic Standard & Assurance
Class 3 represents the highest level of electronic trust under Indian law. Issuance requires multi-factor identity verification comprising PAN validation, Aadhaar e-KYC and mandatory recorded video verification. Built on 2048-bit RSA asymmetric key pairs and SHA-256 cryptographic hashing.
2. Signing vs. Encryption Tokens
Signing Certificate: Authenticates identity, guarantees data integrity and prevents repudiation for DGFT, ICEGATE and GST filings.
Encryption Certificate: Encrypts electronic files for government e-tendering portals. Exporters typically acquire a Combo token.
3. FIPS 140-2 Level 2 Hardware Tokens
Private keys cannot be stored in computer software or cloud drives. Keys are generated inside dedicated cryptographic hardware (ePass 2003, ProxKey, mToken) that automatically lock if an incorrect PIN is entered three consecutive times.
emSigner Configuration and Browser Environment Setup
The DGFT portal utilizes a local signing utility called emSigner to bridge communication between the web browser and the cryptographic USB token. Proper environment setup is essential for successful digital signing:
Java Runtime Environment (JRE)
Ensure an updated 64-bit Java Runtime Environment is installed on the host operating system to execute local WebSocket applet communications.
Token Middleware Drivers
Install the dedicated driver software corresponding to your token hardware (ePass 2003 Setup or ProxKey Driver) so the operating system certificate store detects the crypto-chip.
emSigner Local Port Binding
The DGFT emSigner utility communicates locally over port 1645 or port 8080 using secure WebSockets (WSS). Ensure local firewalls permit communication across https://127.0.0.1:1645.
Browser Certificate Trust
If your browser displays ‘Signer Service Not Found’, navigate manually to https://127.0.0.1:1645 in Chrome or Edge and accept the self-signed localhost security certificate exception.
Experiencing emSigner errors or need a new Class 3 DGFT token immediately?
Our IT compliance desk executes same-day video KYC verification, dispatches pre-configured FIPS USB tokens and configures browser drivers remotely.
Message our DSC technical desk on WhatsApp: +91 8218043048 | View DGFT Advisory Services
Documents Required for Class 3 DSC Issuance
Certifying Authorities issue Class 3 DSCs through automated digital e-KYC pipelines. The following documentation must be assembled based on your business constitution:
| Document | What the Certifying Authority Verifies | The Mismatch That Causes Rejection |
|---|
| Applicant Personal PAN Card | Applicant legal name and date of birth verified against the Income Tax database in real time | Spelling differences between applicant PAN card and Aadhaar identity records |
| Aadhaar Card / Passport | Mobile-linked Aadhaar authentication to receive e-KYC One Time Passwords | Mobile number unlinked from Aadhaar, preventing OTP generation during digital verification |
| Entity Legal Existence Proof | GST Registration Certificate, Certificate of Incorporation or registered Partnership Deed | Enterprise trade name used on the application differing from the legal name on the corporate PAN |
| Board Resolution / Authority Letter | Formal corporate resolution authorizing the applicant to hold and sign with the organizational DSC | Authorization letter signed by an unauthorized officer or missing company seal and director signatures |
| Entity Bank Account Proof | Latest bank statement or pre-printed cancelled cheque verifying active business banking facilities | Bank account statement in proprietor personal name without enterprise commercial name linkage |
How to Obtain and Configure a Class 3 DSC, Stage by Stage
The complete lifecycle from electronic application to active browser signing follows five structured phases:
1
Stage 1: Document Scrutiny & e-KYC Account Creation
Our technical desk audits applicant identity records and company documentation. We generate an online e-KYC file with a licensed Certifying Authority (such as eMudhra, Capricorn or VSign). The applicant receives an OTP on their Aadhaar-registered mobile number to confirm identity.
2
Stage 2: Live Video Verification
The applicant completes a mandatory 30-second video recording via smartphone or webcam, reading a dynamic code and displaying their original PAN card and address proof. The CA compliance officer approves the record upon automated facial matching.
3
Stage 3: Cryptographic Token Download
Once approved, the cryptographic certificate is downloaded onto a blank FIPS 140-2 Level 2 USB hardware token. The private key is generated directly within the crypto-chip, preventing any external extraction or unauthorized duplication.
4
Stage 4: Token Driver Installation & emSigner Setup
Insert the USB token into the workstation. Run the integrated installer to deploy token middleware drivers. Install the latest DGFT emSigner utility, launching the program as Administrator to bind local WebSocket communications.
5
Stage 5: Mapping DSC on dgft.gov.in & ICEGATE
Log into DGFT, navigate to ‘User Profile’ -> ‘View / Register Digital Signature Certificate’, select your token, enter your PIN and confirm mapping. The portal validates that the PAN matches the authorized director on the IEC. On ICEGATE, map the token under ‘DSC Management’.
Where Digital Signatures Go Wrong
Cryptographic errors are technical and unforgiving. The following table identifies common failure points and their solutions:
| Operational Failure | What You See on Portal / Screen | What Actually Broke |
|---|
| Signer Utility Connection Refused | “Unable to communicate with the local emSigner service” | The emSigner application is not running in the system background or browser security blocks local WebSocket port 1645. |
| Token User PIN Blocked | “User PIN is locked. Please contact your administrator” | Incorrect token PIN entered three consecutive times. Token must be reset using the master Admin PUK code via token manager. |
| Unauthorized DSC Mapping | “The PAN in the digital signature does not match IEC records” | An individual personal DSC was used instead of an organizational DSC or the director signing is not listed on the DGFT IEC profile. |
| Certificate Not Detected | “No certificates found in the token” | Token middleware driver software is missing or corrupt, preventing the operating system from reading the hardware crypto-chip. |
| Expired Certificate Rejection | “Digital signature has expired and cannot be used for signing” | The certificate passed its validity date (1, 2 or 3 years). A fresh certificate must be downloaded onto the token via video KYC. |
What a Digital Signature Certificate Will Not Do
Understanding the statutory limits of a DSC prevents operational confusion:
- A DSC does not grant automatic trade permissions or licenses: A DSC is strictly an authentication tool. It does not replace the requirement to apply for and obtain statutory DGFT authorisations like IEC, RCMC, Advance Authorisation or EPCG.
- A DSC cannot be duplicated or shared across multiple machines simultaneously: Because the private key is permanently bound to the physical USB hardware token, simultaneous signing from multiple workstations is impossible without purchasing separate certificates.
- A DSC does not automatically renew upon expiration: Due to statutory CCA regulations, expired certificates cannot simply be reactivated; the authorized signatory must complete fresh Aadhaar OTP and video verification for renewal.
Related DGFT Licensing & Trade Compliance Services
Explore our integrated compliance advisory services to keep your export-import enterprise fully compliant and operationally efficient:
Statutory RegistrationTen-digit Importer Exporter Code issuance, PAN integration, mandatory annual renewals and portal de-activation recovery.
View IEC Details
Council RegistrationRegistration Cum Membership Certificate filings with Export Promotion Councils and Commodity Boards to access export benefits.
Explore RCMC Details
Duty ExemptionDuty-free import of raw materials and manufacturing inputs based on Standard Input Output Norms with complete EODC redemption support.
Explore Advance Authorisation
Capital MachineryZero customs duty import of capital equipment against export commitments, including installation audit certificates and obligation discharge.
Read EPCG Guide
Exporter RecognitionStatus Holder accreditation delivering self-certification privileges, bank guarantee waivers and priority green channel customs clearance.
View Status Holder Guide
Customs Port IntegrationElectronic bank AD code registration and IFSC mapping across ICEGATE customs EDI locations for direct export proceeds tracking.
Read AD Code Guide
Have more questions?Visit our complete EXIM & DGFT Knowledge Base with 50+ answers about Foreign Trade Policy, export schemes, customs and more. Frequently Asked Questions
What class of Digital Signature Certificate is required for DGFT filings?
Under current Controller of Certifying Authorities guidelines, a Class 3 Digital Signature Certificate is mandatory for all DGFT transactions. For companies and LLPs, the DSC must be an Organizational certificate embedding the firm IEC and authorized signatory PAN.
Can I use my personal Class 3 DSC to file applications for my company on DGFT?
No. The DGFT platform requires an Organizational DSC for corporate entities, partnerships and LLPs. An individual personal DSC will fail demographic verification on the portal because it lacks corporate IEC organizational metadata.
What is a FIPS 140-2 cryptographic hardware USB token?
A FIPS 140-2 Level 2 USB token is a dedicated hardware security device (such as ePass 2003 or ProxKey) designed to generate and store cryptographic keys securely. The private key cannot be exported or copied, protecting your digital signature against unauthorized duplication.
What should I do if my USB token User PIN gets blocked?
If you enter an incorrect token PIN three consecutive times, the token automatically locks for security. You must launch the token manager software on your workstation and use the master Administrator PUK code provided at issuance to reset the user PIN.
How long does it take to issue a Class 3 DSC?
With Aadhaar e-KYC and smartphone video verification, a Class 3 DSC is typically approved by the Certifying Authority within 30 to 60 minutes. The certificate is downloaded directly onto the hardware USB token for immediate dispatch or remote setup.
Can the same Class 3 DSC be used on both DGFT and ICEGATE?
Yes. A single Class 3 Organizational DSC can be registered and used across the DGFT portal, CBIC ICEGATE, the GST refund portal (RFD-01), Ministry of Corporate Affairs (MCA21) and government e-procurement portals.
What is emSigner and why is it required for DGFT transactions?
emSigner is a specialized cryptographic utility published by DGFT that runs locally on your workstation. It facilitates secure communication between your web browser and the USB hardware token, enabling digital signing over local WebSocket port 1645 or 8080.
What causes the “Unable to communicate with local emSigner service” error?
This error occurs when the emSigner application is not running in the system background, local firewall rules block port 1645 or the browser security settings reject the localhost SSL certificate. Running emSigner as Administrator and accepting the browser certificate exception resolves the issue.
How do I renew an expired Digital Signature Certificate?
Digital signatures cannot be automatically extended. Exporters must complete fresh Aadhaar OTP verification and a recorded video identity check. The newly generated certificate is then flashed onto your existing USB token or a fresh hardware token.
Is a Digital Signature Certificate mandatory for sole proprietorships on DGFT?
For sole proprietorships, many basic DGFT profile updates can be authenticated using Aadhaar e-Sign OTP. However, an organizational Class 3 DSC is strongly recommended for high-volume transactions, customs broker authorizations and ICEGATE shipping bill filings.
How Rasp International Handles Digital Signature Solutions
Rasp International is an ISO 9001:2015 certified foreign trade advisory firm located at A-39, New Agra Colony, Agra, Uttar Pradesh 282005. Built on a family trade legacy dating back to 2005, we have advised more than 500 exporters across India on digital identity compliance, customs licensing and trade automation.
Our technical desk provides same-day issuance of CCA-licensed Class 3 DSCs, configures FIPS hardware tokens, resolves emSigner browser conflicts and completes direct portal mapping on DGFT and ICEGATE to keep your cross-border operations running without interruption.
Secure Your Class 3 Trade Signing Credentials
Whether you require a new organizational DSC, an emergency token replacement or emSigner technical support, our IT trade specialists ensure immediate turnaround with zero downtime.
Statutory Sources & Regulatory References
Disclaimer: This statutory technical guide is provided for administrative and trade compliance planning based on regulations established by the Controller of Certifying Authorities and the Directorate General of Foreign Trade. Hardware specifications, cryptographic drivers and portal interfaces are subject to periodic technical updates by government regulatory bodies.
Related Resources: DGFT Consultants & Licensing Services | IEC Registration & Compliance | RCMC Registration Guide | AD Code Registration at Customs Ports