Class 3 DSC for tenders in 2026: signing vs encryption, tokens, CPPP and GeM mapping, and the errors that cost bids

Every Indian eProcurement portal authenticates you and signs your bid with a Digital Signature Certificate. Buy the wrong class or key usage, or map it wrongly, and nothing else in the bid matters. This is what to buy, from whom, and how to keep it working on CPPP, the state GePNIC portals and GeM.

Why Class 3, and only Class 3

The Controller of Certifying Authorities issued guidelines on 26 November 2020 under which Class 2 was discontinued from 1 January 2021. Everything issued since is Class 3, and any Class 2 certificate bought before the cut-off has run out.

CPPP’s DSC FAQ is explicit: a “DSC of Class 3 category issued by a licensed Certifying Authority” is needed for the eTendering portal, it is mandatory for e-filing, and it belongs to an individual, not the company. The director or authorised signatory who signs for the firm holds it. CCA has also advised application owners that valid DSCs from any licensed CA must be accepted, so a portal cannot push you to one vendor.

Signing vs encryption: which portals want both

A DSC token can carry one key pair or two. The signing certificate authenticates your login and signs what you upload. The encryption certificate is a second key pair used to encrypt and decrypt data. A token with both is sold as a combo.

What the portals themselves say is narrower than what tender notices demand:

• CPPP’s hassle-free bid submission guide tells bidders to keep ready a “valid Digital Signature Certificate (Signing) of Class III issued by CA under CCA India”. It also explains that bids are encrypted using the certificates of the buyer’s pre-designated bid openers, which is why the DSC FAQ tells department users, not bidders, to get “two pairs of Keys (One for Signing and One for Encryption)”.
• State GePNIC portals run the same NIC software, but PSU and institute notices on them routinely specify both. BHEL’s instructions, for example, ask for a Class III SHA2 2048-bit DSC “with signing and encryption” for login and bid submission (BHEL).
• GeM has enabled DSC for bid publishing, bid participation, order placement, CRAC and bill generation, and offers Aadhaar-based e-Sign through eMudhra alongside OTP verification (GeM feature notes). Nothing GeM publishes requires an encryption certificate.

The practical answer is to buy the combo for the signatory who bids on NIC portals. A tender notice that asks for encryption will not be argued with.

Tokens

The private key lives on a USB crypto token and never leaves it. CCA moved certifying authorities to a new series of empanelled tokens from 1 April 2023, allowing the older series only until 30 June 2023 (CCA notice), so a token bought before 2023 may not accept a renewed certificate. NIC’s signing component auto-detects Trustkey, Proxkey, Gemalto and ePass 2003 tokens and allows a custom driver for others (NICDSign FAQ). One token per signatory. Tokens lock after repeated wrong PINs, and an unlock means the CA.

Buying: licensed CAs, validity and price

CCA lists 23 licensed CAs, of which 12 issue crypto-token DSCs to the public: Safescrypt (Sify), (n)Code, eMudhra, Capricorn, Vsign (Verasys), Pantasign, RISL (RajComp), IDSign, XtraTrust, ProDigiSign, SignX and Care4Sign. Most sales run through registration authorities and resellers, which is why quotes for the same certificate differ.

Indicative ranges from a July 2026 price survey; CPPP’s FAQ puts the cost at ₹2,000 to ₹3,000 depending on years. GeM itself lists a two-year combo with token at around ₹1,700. CPPP’s FAQ still describes validity of one or two years; CAs now sell three. Issue time is three to seven days per CPPP, faster with eKYC. Buy an organisation-type certificate in the name of the authorised signatory, and expect the CA to ask for PAN, Aadhaar and an authorisation letter.

Mapping the DSC on CPPP and GePNIC portals

The sequence on every NIC portal, per CPPP’s bidder instructions:

1. Online enrolment with a unique user ID and password.
2. Log in, then enrol the DSC with the token inserted.
3. Use My Documents to pre-load certificates and work orders that you attach to bids later.

Two rules bite. The registered token “should not be misused by others”, and “DSC once mapped to an account cannot be remapped to any other account. It can only be inactivated.” A renewed certificate is therefore enrolled fresh against your existing account, and each state portal is a separate enrolment with the same token, which is why our portal comparison lists DSC mapping as a per-portal cost.

Signing needs a local signer the browser can talk to. Older GePNIC guidance lists a Java Runtime Environment among prerequisites, and the hassle-free guide suggests increasing JRE memory for large uploads. NIC’s current signer, NICDSign 3.0, is built in Rust and removes the Java dependency; the browser must trust its local service over HTTPS.

Mapping the DSC on GeM

GeM registration is Aadhaar or PAN based and must be done by the authorised person, with secondary users for bid participation registered the same way (GeM prerequisites). The DSC should be in that person’s name and registered against that user before participation. GeM also offers e-Sign, but a DSC in the hands of the bid desk remains the dependable default: it works offline from Aadhaar OTP delivery and is what buyers expect on order acceptance and invoices.

Common errors and fixes

Renewal timing relative to bid validity

A renewal is a new certificate, not an extension, so every portal needs the new one enrolled. You need a live certificate to submit, to resubmit after a corrigendum, to withdraw, to join a GeM reverse auction, to accept an order and to sign the contract. After submission on a NIC portal, the bid is already signed and encrypted to the openers’ keys, so an expiry during evaluation does not void it, but it freezes you out of every later action.

Our rule: renew 30 to 45 days before expiry, never in the last 48 hours of a live bid, and keep a second authorised signatory with a mapped DSC. The tender document checklist treats the DSC like any other expiring document, because it is one.

What to automate

• Expiry calendar for every signatory’s DSC on every portal, with alerts at 45, 30 and 7 days.
• Pre-bid readiness check: token detected, driver present, signer running, browser trust in place, run the day before submission.
• Signatory roster: who is mapped where, with a backup for each portal.
• Renewal workflow: CA order, documents, and a re-enrolment checklist per portal, tracked to done.

The signing itself stays human. Our tender automation work stops at the point where a person inserts the token; see where in the tender desk demo.