How to Check DSC Expiry Date: 4 Quick Ways (2026)

You can check a DSC's expiry date in about a minute: open the USB token's own software, Windows Certificate Manager, or the signer utility on the tax portal.

That's the easy part. The harder part, if your firm looks after dozens of client tokens, is finding out before it matters. Most CA offices have lived some version of this: it's the last evening before the tax audit deadline, the report is ready, and the director's DSC turns out to have expired three weeks ago. A new certificate needs fresh verification, and the director is in a meeting in another city.

Below are the four ways to check validity, what actually happens at expiry, and how to stop it catching your office off guard.

Method 1: The token's own software

Every DSC token comes with a small utility, usually installed along with the driver the first time the token was used on that computer. The name depends on the token. ePass2003 and HYP2003 have their own token managers, and ProxKey and mToken have theirs.

1. Insert the token and open its token manager from the Start menu.
2. Select the token. Some tools ask for the token PIN here; others let you view certificates without it.
3. Open the certificate, usually through "View certificate" or "Certificate details".
4. Check the validity period. "Valid from" is the issue date and "Valid to" is the expiry.

While you're in there, note the holder's name and the Certifying Authority that issued it (eMudhra, Capricorn, Sify and so on). You'll want that when it's time to apply for the next one.

Method 2: Windows Certificate Manager

If the token driver is installed, Windows reads the certificate when the token is plugged in. This is useful when nobody remembers which software goes with which token.

1. Press Windows + R, type certmgr.msc and press Enter.
2. Go to Personal > Certificates.
3. Find the certificate by the holder's name. The Expiration Date column shows the expiry; double-click the entry for full details.

One quirk: Windows often keeps older certificates in this list after the token has been removed or replaced. If you see two entries for the same person, go by the later date and confirm on the token itself.

Method 3: At the point of signing

When you sign on the income-tax or GST portal, the emSigner utility lists the certificates it can see, and an expired one either won't be offered or will fail when you try to sign. On the income-tax portal, the Register DSC option under your profile shows whether a DSC is registered and lets you replace it.

This works, but it tells you about expiry at exactly the moment you don't want to find out. Treat it as a last check, not your system.

Method 4: The issue email or your DSC vendor

When a DSC is issued, the Certifying Authority or the reseller sends an email with the order and validity details. If you bought through a local DSC vendor, they can usually look up the expiry from the applicant's name or order number. It's the least technical option, and it's the one that works when the token is sitting in the client's office and not yours.

What happens when a DSC expires

At the expiry date the certificate simply stops working for new signatures. There's no penalty and nothing is cancelled on any portal, but you can't sign ITRs, audit reports, GST filings, MCA forms or tenders with it until a new certificate is issued.

Documents signed while the certificate was valid remain valid. An audit report signed in June doesn't become defective because the DSC expired in August.

"Renewal" is really a fresh application

Everyone says renew, but what you actually do is apply for a new certificate. Only Class 3 DSCs are issued now (Class 2 was discontinued from 1 January 2021), and the identity-verification guidelines from the Controller of Certifying Authorities require fresh verification each time, including video verification for most applicants. The holder has to be available for OTPs and a short video.

Class 3 certificates are usually sold with one- or two-year validity, and some Certifying Authorities also offer three years. The existing token can normally be reused if it's a supported model, which at least saves a courier trip.

The practical point: a DSC can't be sorted out at 9 pm on deadline day for a director who's travelling. Give it a few working days.

The step everyone forgets: registering the new DSC again

A new certificate has a new serial number, so every portal that knew the old one needs to be told. Before the next filing, re-register it on:

• Income-tax e-filing portal: Register DSC, under the profile.
• GST portal: Register / Update DSC for the authorised signatory. This is mandatory for companies and LLPs.
• MCA portal: associate the new DSC with the director's or professional's login.
• TRACES: re-register under the profile if the deductor signs requests with a DSC.
• EPFO employer portal: the authorised signatory's new DSC may need approval again.

Skipping this is how a freshly renewed DSC still fails on filing day.

Looking after client DSCs in a CA firm

Most firms end up holding client tokens, at least for some clients. It's convenient and clients often prefer it. It's also a responsibility. Section 42 of the Information Technology Act expects the certificate holder to keep control of their private key, so if the token and the PIN live in your office, you're holding that control on the client's behalf.

A few habits keep it safe and predictable:

• Keep a DSC register. Client, holder name, PAN, Certifying Authority, issue date, expiry date, token type and where the token physically is right now.
• Log every movement. Out to the client, back to the office, handed to a staff member for a filing. Date and name, every time.
• Get written authority from the client to hold and use the token for defined work.
• Don't write the PIN on the token. Obvious, yes. Walk around most offices and you'll still find one.
• Send reminders at 30, 15 and 7 days before expiry, to the client as well as the staff member, because the client is the one who has to do the video verification.
• Return tokens when an engagement ends, and record the handover.

For a small practice, a spreadsheet can hold all of this. Past a hundred or so tokens, the weak point is the reminders. Somebody has to open the sheet, sort by expiry and chase people every week, usually during the busiest months of the year, which is exactly when it stops happening.

Where software helps

DSC tracking is repetitive and date-driven, which makes it a good fit for practice management software. In QwikCA, each client's DSC sits on the client record with its expiry date, reminders go out automatically (WhatsApp included), and every time a token leaves or comes back to the office it's logged against a person. When a partner asks where a particular client's token is, the answer is a search, not a round of phone calls.

FAQs

Can I sign with an expired DSC?

No. Portals reject signatures from an expired certificate. You need a new DSC, registered on the portal you're filing on.

How long is a DSC valid?

Class 3 DSCs are usually issued for one or two years. Some Certifying Authorities also sell three-year certificates.

Is there a penalty if a DSC expires?

No. You just can't sign anything until a new certificate is issued and registered. The real cost is the filing you miss while that happens.

Is a Class 2 DSC still valid?

No. Class 2 certificates were discontinued from 1 January 2021, and any issued before that are long past their validity. Only Class 3 DSCs are issued now.

Can a CA firm keep a client's DSC?

Many do, with the client's consent. Keep written authority, a register and a movement log, and remember that the holder stays legally responsible for the key.

Portal menus and verification rules change from time to time. Check the current process with your Certifying Authority or on the relevant portal before a deadline.