Every e-tender portal asks for a digital signature certificate (DSC), but they do not all ask for the same one. A DSC that works on CPPP can be refused on IREPS, and one that works on IREPS can fail on Telangana’s portal. This guide shows what each major portal needs, so you buy the right DSC once.
Everything below comes from the portals’ own pages and manuals, checked on 17 October 2026. Each portal also has a full guide of its own, linked in the table.
The short answer
- Class 3 only. Class 2 certificates are no longer issued.
- Signing only works on IREPS, CPPP and the NIC state portals. Telangana, Andhra Pradesh and nProcure also need an encryption certificate.
- Names matter. IREPS wants your firm’s name in the DSC; Karnataka wants the name exactly as on your PAN.
- One DSC can serve many portals, but you enroll it on each one.
- Tokens: from 21 September 2026, new DSCs are issued on FIPS 140-3 tokens. Telangana and Andhra Pradesh check your token before you bid.
What each portal needs
| Portal | Certificates | Name rule | Software |
|---|---|---|---|
| GeM | Not needed to log in. To sign, an OTP or e-sign also works for now | - | - |
| IREPS | Signing | Firm’s name in the organisation field; not “Personal” | IREPS Signer (Windows) with Java 8 |
| CPPP and NIC state portals | Signing | Issued to a person, such as the authorised signatory | The token’s driver; Chrome, Firefox or Edge |
| Telangana | Signing and encryption | - | emSigner 1.3.1 (Windows); token must pass the OAEP check |
| Andhra Pradesh | Signing and encryption | - | emSigner 1.3.1 (Windows); token must pass the OAEP check |
| Karnataka (KPPP) | Class 3 with a valid expiry date | Exactly as on your PAN | KPPP Digital Signer extension and eSigner kit, Java 11 or above |
| nProcure (Gujarat) | Signing and encryption, as a combo | Organisation or individual | nProcure’s PKI component, Java 1.8 or above |
All of them take only Class 3 DSCs, from a certifying authority licensed by the Controller of Certifying Authorities (cca.gov.in). The NIC row covers CPPP, etenders.gov.in, defproc.gov.in and 29 state and union territory portals, including MahaTenders, Kerala, Uttar Pradesh, Tamil Nadu, Odisha, Punjab, Rajasthan and Jammu and Kashmir.
Which DSC to buy
- Only central portals and NIC state portals: a Class 3 signing certificate is enough.
- IREPS: make it an organisation DSC that carries your firm’s name, with the same address you register with. IREPS refuses a DSC whose organisation field is empty or says “Personal”, and this applies to proprietorships too.
- Telangana, Andhra Pradesh or Gujarat: buy the signing and encryption combo.
- Bidding everywhere: a Class 3 organisation DSC with both signing and encryption certificates, in the authorised signatory’s name exactly as on their PAN and with your firm in the organisation field, meets the rules in the table above.
Prices are set by each certifying authority and depend on the validity and the token. MahaTenders’ DSC FAQ puts it at roughly ₹2,000 to ₹3,000, but check current prices with the authority you buy from.
The token: FIPS 140-3 and the OAEP check
The Controller of Certifying Authorities’ advisory on FIPS 140-3 moves DSC tokens from the FIPS 140-2 security standard to FIPS 140-3. It asked certifying authorities to stop issuing DSCs on FIPS 140-2 tokens by 21 September 2026. A DSC downloaded onto an older token by then keeps working until it expires, but you cannot renew it or download a fresh DSC onto that token. Telangana and Andhra Pradesh upgraded their emSigner to version 1.3.1 in October 2026 and now check tokens:
- Hyper tokens: run the “Test Hyper2003 Token OAEP Supported Check” from the portal’s downloads. Y means the token works; N means it does not.
- Other tokens: on Telangana’s portal, Check Your DSC Token should show OAEP Supported: true.
- If it fails: ask your token vendor for a compatible token. Andhra Pradesh’s guide adds that you then redo the video re-KYC and install your certificate on the new token.
When you buy a new token, ask the vendor for one that meets FIPS 140-3 and supports OAEP.
Rules that catch people out
- One DSC, one account. On NIC portals a DSC maps to one user account at a time, and a mapped DSC cannot be moved to another account, only inactivated.
- New DSCs take time. Certifying authorities take three to seven days, says MahaTenders’ FAQ, and NIC portals can take up to 24 hours more to activate a new DSC.
- Renewing is a portal step too. IREPS: Click Here To Change your Signing Certificate. NIC portals: remove the old DSC from your dashboard, or let it expire, and enroll the new one at login. KPPP: renew and map it again. Telangana: Reset DSC. Andhra Pradesh: Reset Certificate.
- Names must match. IREPS links a new DSC only if the name matches the user account.
- Never share your token or PIN. NIC’s FAQ says using another firm’s DSC to upload a bid is illegal under the IT Act, and IREPS’s terms make you responsible for everything done with yours. Too many wrong PINs block the token; only the certifying authority can unblock it.
Questions people ask
Do I need a Class 2 or Class 3 DSC for tenders?
Class 3. Class 2 certificates are no longer issued: the Controller of Certifying Authorities stopped them in its guidelines of November 2020. E-tender portals ask for Class 3.
Do I need a signing certificate, an encryption certificate, or both?
It depends on the portal. IREPS, CPPP and the state portals on NIC’s software ask bidders for a signing certificate only. Telangana, Andhra Pradesh and nProcure (Gujarat) also need an encryption certificate, so buy a signing and encryption combo if you bid there.
Do I need a DSC for GeM?
Not to register or log in. To sign bids, contracts and invoices, GeM accepts an OTP, e-sign or a Class 3 DSC, and says OTP signing will be withdrawn later.
Can I use one DSC on several tender portals?
Yes. NIC’s DSC FAQ says a valid DSC bought for one e-tendering portal can be enrolled on another. You still enroll it on each portal, and it must meet each portal’s rules, such as the firm’s name for IREPS and an encryption certificate for Telangana.
Should I buy an individual or an organisation DSC for tenders?
For IREPS you must have the firm’s name in the DSC: IREPS refuses a DSC whose organisation field is empty or says “Personal”, even for a proprietorship. NIC portals issue the DSC to a person, such as a director or the authorised signatory. An organisation DSC in the signatory’s name, with the firm in the organisation field, meets both.
How long does it take to get a DSC?
MahaTenders’ DSC FAQ says certifying authorities take three to seven days. After that, NIC portals say a new DSC can take up to 24 hours to become active on the portal, so do not leave it to the last day.
What is FIPS 140-3, and is my token affected?
It is the newer security standard for DSC tokens. The Controller of Certifying Authorities asked certifying authorities to stop issuing DSCs on older FIPS 140-2 tokens by 21 September 2026. A DSC already on an older token keeps working until it expires, but cannot be renewed onto that token. Telangana and Andhra Pradesh also check tokens with an OAEP test; a Hyper token that shows N must be replaced through your token vendor.
What happens if my DSC expires during a tender?
You cannot sign until you renew and register the new DSC on the portal. On NIC portals an expired DSC is inactivated and the portal asks for a new one at your next login; on IREPS, register the new one with Change your Signing Certificate. Renew well before expiry.