A digital signature certificate (DSC) is an electronic certificate that ties a person's signature to their verified identity, using encryption. It is the strongest form of electronic signature in India. Company directors, chartered accountants and businesses use it to sign filings on government portals, such as company filings with the Ministry of Corporate Affairs (MCA), some income tax returns and government tenders.
A DSC rests on public key infrastructure (PKI). Each signer has two linked keys. The private key is kept secret, usually on a USB token, a small device that looks like a pen drive. The public key can be shared with anyone. Something signed with the private key can be checked with the public key, but the public key cannot be used to sign. The certificate is a file, issued by a certificate authority, which states that this public key belongs to this person. In India, certificate authorities are licensed by the Controller of Certifying Authorities (CCA).
Here is how a DSC is issued and used. Say a chartered accountant in Vadodara needs a DSC to sign his clients' company filings. He applies to a certificate authority with his PAN and Aadhaar. The authority checks his identity, including a short video call, much as a bank checks a new customer through identity verification. It issues a Class 3 certificate, valid for two years. The key pair is created inside his USB token, and the private key never leaves the token.
In October, he signs a client company's financial statements, a 12-page PDF that is filed with the MCA. His software calculates a hash of the PDF: a short code of fixed length, computed from the file's contents. Any change to the file changes the hash. The token encrypts the hash with his private key. This encrypted hash is the digital signature, and it is attached to the PDF together with his certificate. When the MCA portal receives the file, it decrypts the signature with his public key, and computes the hash of the file again. The two hashes match. So the portal knows that the file has not changed, and that he signed it. It also checks that his certificate has not expired or been cancelled.
DSCs are used beyond government filings. Agreements paid for through e-stamping and some banking documents can be signed with them too. Other countries use the same idea under their own laws. In Indonesia, for example, a company that verifies a person's identity can also issue that person a certificate for signing.