Short answer: To bid on Indian e-procurement portals you need a Class 3 Digital Signature Certificate (DSC) issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA), stored on a USB crypto token. NIC GePNIC portals such as CPPP and most state portals ask for a Class 3 signing certificate, while several PSU portals also insist on a separate encryption certificate, so most first-time bidders buy the signing plus encryption set. Take it as an organisation DSC in the name of the person who will sign bids, then register it on every portal you plan to use.
What is a DSC and why do e-tender portals need one?
A Digital Signature Certificate is the electronic equivalent of your signature and company seal, recognised under the Information Technology Act, 2000. On an e-procurement portal it does two jobs:
- It proves who you are when you log in and when you submit. Every document you upload is digitally signed, so the buyer knows the bid came from you and has not been altered.
- It protects the bid until opening. On NIC's GePNIC platform, the portal encrypts bid documents using the certificates of the buyer's designated bid openers, so nobody can read your bid before the opening date and time (CPPP bid submission guidelines).
You do not need a DSC to search or read tender notices. You need it to enrol as a bidder, download documents on many portals, and submit. If you are new to the overall process, start with what e-tendering is in India and our CPPP step-by-step guide.
Which DSC class is required for e-tendering?
Class 3. The CCA's Identity Verification Guidelines say Certifying Authorities issue Class 3 individual signing certificates, which also carry the Class 2 identifier, and must not issue Class 2 signing certificates on their own (CCA-IVG). In practice, Class 2 certificates stopped being issued from 1 January 2021, and any old Class 2 certificate you still hold will expire and cannot be renewed as Class 2.
NIC's own guidance for GePNIC portals tells bidders to keep a valid Class III signing certificate ready well before the bid due date. GeM's FAQ also states that only Class 3 certificates can be used for digital signing on GeM.
Signing vs encryption certificate: do I need both?
A Class 3 DSC can be issued as a signing certificate, an encryption certificate, or both. The CCA's interoperability guidelines require encryption certificates to be separate from ordinary signing certificates, which is why the "combo" comes as two certificates on one token.
| Signing certificate | Encryption certificate | |
|---|---|---|
| What it does | Signs your login and every bid document | Encrypts (seals) data so only the intended reader can open it |
| Needed on NIC GePNIC portals (CPPP, most states) | Yes | Not asked of bidders; bids are encrypted with the bid openers' certificates |
| Needed on some PSU and other e-procurement systems | Yes | Often yes, as a separate certificate |
| Key backup | Key never leaves the token | The CA must keep an escrow copy you can recover after verification |
Some large buyers have told bidders in writing that they need a Class 3 organisation DSC along with an encryption certificate for their e-tender systems. Because you rarely know in advance which portals you will bid on, the safe choice is the Class 3 signing plus encryption set. It costs a little more than signing only, and it saves you from buying a second certificate a week before a deadline.
One useful rule from the CCA guidelines: for encryption certificates the CA has to keep the key in escrow for at least seven years after expiry, so you can recover it later after video verification. Keep your own copy safe as well.
Individual or organisation DSC: which should I take?
Every DSC is issued to a person, never to a company alone. The difference is what else it carries:
- Individual (personal) DSC: your name and personal details only. Fine for a proprietor bidding in their own name, but many tenders expect the signatory to be linked to the bidding entity.
- Organisation DSC (organisational person certificate): your name plus your organisation's name, issued after the CA verifies that the organisation exists and that you are authorised to sign for it. This is the normal choice for e-tendering.
Take the DSC in the name of the person who will actually sign bids, usually a director, partner, proprietor or an authorised employee. The name on the DSC should match the authorised signatory named in your power of attorney or board resolution in the bid; a mismatch is a common reason for queries during evaluation.
What documents do I need to get a DSC?
The exact list depends on the CA, but the CCA's Identity Verification Guidelines set the minimum. Expect the following.
For the applicant (every DSC):
- PAN and mobile number (both mandatory), plus an email address for DSC issuance.
- Identity verification through Aadhaar eKYC, PAN-based eKYC or other permitted routes, followed by a short video verification with the CA.
- A photograph and address proof, where the eKYC route requires it.
For an organisation DSC, add:
| Type of bidder | Proof of authority (typical) | Proof the organisation exists (typical) |
|---|---|---|
| Proprietorship | Business registration showing the proprietor | GST verification, or a recent bank statement in the firm's name plus a business registration certificate |
| Partnership firm | List of partners from the deed; authorisation letter from a partner if the signatory is not a partner | GST verification or equivalent documents |
| Company or LLP | List of directors (the CA cross-checks with MCA); board resolution or power of attorney if the signatory is not a director | GST verification or equivalent documents |
| Society, trust or NGO | Resolution authorising the signatory | Registration documents or GST verification |
The guidelines also allow self-authorisation for a single-director company or a proprietor. Check your CA's current checklist before applying, as CAs may ask for more.
Where can I buy a DSC?
Only from a Certifying Authority licensed by the CCA (or its registration partners). The CCA publishes the official list of licensed CAs; buy from one of them, or from a reseller who can show which licensed CA will issue the certificate. Prices vary by CA, validity and whether you take signing only or signing plus encryption, so compare quotes directly.
A typical purchase looks like this:
- Choose a licensed CA and select Class 3, organisation, signing plus encryption, and the validity you want.
- Fill the online form and complete eKYC, mobile and email verification.
- Upload organisation documents and the authorisation letter, if applicable.
- Complete the video verification.
- After approval, download the certificate onto your USB token using the CA's software. The CCA requires the key to be generated on the hardware token; the guidelines give 30 days from approval to complete the download.
What is a USB token and how long is a DSC valid?
The USB token (crypto token) is a small hardware device that holds your private key. The CCA requires Class 3 signing keys to be generated and kept on a validated hardware token, so you cannot simply copy a DSC file between computers. Practical points:
- Set a strong token PIN and do not leave the default; CAs are not allowed to download a DSC to a token that still has a default password.
- Forgetting the PIN usually means the token must be reset and the certificate re-issued.
- Install the token's driver from the token maker or your CA on every computer you bid from.
Validity: CAs commonly sell DSCs with 1, 2 or 3 years of validity, and the expiry date is inside the certificate. Note the expiry date in your calendar with a one-month reminder. When you renew you get a new certificate, which must be registered again on each portal.
How do I register my DSC on CPPP and state GePNIC portals?
All NIC GePNIC portals (CPPP at eprocure.gov.in and the state portals listed in our state e-procurement portal list) follow the same pattern:
- Open Online Bidder Enrollment on the portal and create your account with an email ID as login ID, company details and mobile number.
- Log in with the login ID and password. You will be asked to change the password on first login.
- Insert the USB token. The portal will list the certificates it can read; select your signing certificate and confirm to register it against your account.
- From then on, log in with your password and the DSC (the token PIN acts as the second factor).
- When your DSC expires or you get a new one, log in and use the portal's option to update or re-register the certificate before you start a bid.
Registration on one GePNIC portal does not carry over to another; repeat these steps on each portal. Bidder enrolment on CPPP is free; check any fee on each state portal. NIC advises bidders to complete enrolment well before any deadline and to use the portal's Bidder Manual Kit, FAQs and help desk.
What about GeM: DSC or Aadhaar e-sign?
GeM works differently from tender portals. According to GeM's FAQ, documents and transactions on GeM, including bid participation by sellers, can be verified with OTP, e-Sign or a DSC, and GeM has said OTP support is temporary. For DSC signing on GeM only Class 3 certificates are accepted. So you can bid on GeM without a token if you use e-Sign, but if you already hold a Class 3 DSC for tender portals, it works on GeM too. Our GeM first-timer guide and GeM vs CPPP comparison cover the rest.
Why is my DSC not detected, and how do I fix it?
| Symptom | Likely cause | Fix |
|---|---|---|
| "No certificate found" or token not listed | Token driver missing or outdated | Install the latest driver for your token model; unplug and re-insert; try another USB port |
| Signing pop-up never appears | Portal's signing component (Java on older setups, or a signer utility) not installed or blocked | Follow the portal's current system requirements page; allow the component in your browser and security software |
| Works on one PC, not on another | Driver or signing component installed only on the first PC | Repeat the driver and component setup on every computer used for bidding |
| "Certificate expired" or "invalid" | DSC past its validity date | Renew with your CA, download to the token, then re-register on each portal |
| Certificate rejected at registration | Wrong certificate selected (encryption instead of signing) | Select the signing certificate when the portal asks for it |
| Name mismatch questioned by buyer | DSC holder differs from authorised signatory in the bid | Align the DSC holder, power of attorney and bid declarations |
| Logged out mid-upload | Session idle limit, or IP address changed | Avoid switching networks; NIC advises a stable broadband connection rather than mobile data |
NIC also advises bidders to keep their system ready in advance: a supported browser, the right runtime, enough memory and an unrestricted connection to the portal. Test a login with the DSC at least a few days before every deadline, not on submission day.
How Grovia Tender does this
Grovia Tender brings tenders from many sources into one place, and every notice links back to the official portal where you bid. For each tender it checks eligibility against your Company DNA and Document Vault, with the evidence shown per criterion, calculates Win Potential, and Get bid-ready lists the proofs still missing, including an expiring DSC or authorisation letter. AI-drafted sections are traceable to your own documents.
Grovia Tender never submits, signs or prices on your behalf: you approve everything and submit on the portal with your own DSC. Plans: Free ₹0, Pro ₹3,999/month, Business ₹14,999/month, pay-per-bid from ₹1,999 (GST extra). See features, how it works and pricing.
Frequently asked questions
Which class of DSC is needed for e-tendering in India? A Class 3 Digital Signature Certificate issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA). Class 2 certificates are no longer issued, and Class 3 is what CPPP, state GePNIC portals and GeM accept.
Do I need an encryption certificate for e-tender? It depends on the portal. NIC GePNIC portals such as eprocure.gov.in ask bidders for a Class 3 signing certificate, while several PSU and other e-procurement systems also require a separate encryption certificate. Buying a Class 3 signing plus encryption set covers both cases.
Should the DSC be in my name or my company's name? A DSC is always issued to a person. For tendering you normally take an organisation DSC, which carries your name and your organisation's name and is backed by the organisation's authorisation; proprietors and single-director companies can authorise themselves.
How long is a DSC valid? Certifying Authorities usually sell DSCs with 1, 2 or 3 years of validity; the term is printed in the certificate. Renew before it expires and re-register the new certificate on every portal you use.
Why does the e-procurement portal not detect my DSC? The usual causes are a missing or outdated token driver, the portal's signing component not installed or not running, an unsupported browser, or an expired certificate. Install the token driver, follow the portal's system requirements and help desk guidance, then re-insert the token and reload the page.
Get your DSC sorted, then let the paperwork come together for you. Create a free Grovia Tender account and see which tenders you can bid on today.
Frequently asked questions
Sources
- Controller of Certifying Authorities: licensed CAs (cca.gov.in)
- CCA Identity Verification Guidelines (cca.gov.in)
- CPPP: Guidelines for hassle free bid submission (GePNIC) (eprocure.gov.in)
- GeM: user FAQs (gem.gov.in)
Competitor details reflect their public pages on the dates cited and can change; we correct errors on request at info@groviatender.com.