--- title: DSC for tenders: fixing Class 3 bid submission errors · TrackTender description: How a Class 3 DSC works for tenders, plus a practical fix list for the bid submission errors that hit at the last minute on GeM and eProcurement portals. canonical: https://tracktender.com/blog/dsc-for-tenders-and-bid-submission-errors/ source: https://tracktender.com/blog/dsc-for-tenders-and-bid-submission-errors/ --- # DSC for tenders: fixing Class 3 bid submission errors > How a Class 3 DSC works for tenders, plus a practical fix list for the bid submission errors that hit at the last minute on GeM and eProcurement portals. - [Blog](/blog/) / - DSC for tenders: fixing Class 3 bid submission errors Apply & bid - DSC - Troubleshooting - e-procurement # DSC for tenders: fixing Class 3 bid submission errors How a Class 3 DSC works for tenders, plus a practical fix list for the bid submission errors that hit at the last minute on GeM and eProcurement portals. KSKetul Shah02 May 2026 · Updated 13 July 2026 · 8 min read Copied The short version Tenders require a Class 3 DSC issued by a licensed Certifying Authority; Class 2 has been discontinued. In this guide - [What a Class 3 DSC is, and why tenders need one](#what-a-class-3-dsc-is-and-why-tenders-need-one) - [Getting one is quick — renewing late is how you lose](#getting-one-is-quick--renewing-late-is-how-you-lose) - [The errors, and how to actually fix them](#the-errors-and-how-to-actually-fix-them) - [The pattern under all of it](#the-pattern-under-all-of-it) - [Frequently asked questions](#faq) Key takeaways - Tenders require a Class 3 DSC issued by a licensed Certifying Authority; Class 2 has been discontinued. - The DSC must be in the name of the authorised signatory and match your PAN and portal registration, or bids get rejected for non-technical reasons. - Most last-minute signing failures are configuration, not competitiveness: missing token middleware, Java exception-list settings, browser compatibility, or a wrong system clock. - Renewal is the most avoidable loss: a DSC expires silently, so renew two or three weeks early and re-map the new certificate on the portal. - Every error is survivable with time and fatal without it — test your DSC on the portal days before the deadline and submit at least an hour ahead. For government tenders you need a Class 3 DSC — Class 2 has been discontinued — and almost every last-minute signing failure is configuration, not the certificate: missing token middleware, Java exception settings, the wrong browser, or a wrong system clock. The fixes are below; each one takes minutes if you have hours, and kills the bid if you have minutes. It’s 5:50pm. The bid closes at 6:00pm. You’ve spent two days on this tender, the price is sharp, every document is uploaded, and you click sign. Nothing. The token is plugged in, the light is on, and the screen says no certificate found. Ten minutes left, and the one thing between you and a submitted bid is a piece of plastic the size of a USB drive that has decided to stop existing. If you’ve bid on government tenders in India, some version of this has happened to you. The DSC is the single most common point of last-minute failure, and almost none of it is about your competitiveness. It’s configuration. So here’s what a DSC actually is, how to keep it healthy, and how to fix the specific errors when they hit — because the official portals bury all of this in PDFs nobody reads until it’s already 5:50pm. ## What a Class 3 DSC is, and why tenders need one A Digital Signature Certificate is your legal signature in electronic form. It proves who you are and binds you to what you submit, the same way an ink signature and a company seal do on paper. On a government e-procurement portal there is no paper, so the DSC does that entire job. ### Why Class 3 is the only option now For tenders you need a Class 3 DSC. There used to be Class 2, but it’s been discontinued, so Class 3 is the only one that matters now. It’s issued by a licensed Certifying Authority — eMudhra, Sify, Capricorn, (n)Code, Pantasign and others — under the [Controller of Certifying Authorities](https://www.cca.gov.in/). It comes as a private key stored on a hardware crypto token, a small USB device you physically plug in. The certificate can’t be copied off the token. That’s the whole point: nobody can sign as you without the physical device and the PIN. ### Two things people get wrong from the start First, the DSC must be in the name of the authorised signatory — the person who can legally bind the firm — and the name should match your PAN and the registration on the portal. A mismatch here causes [rejections that have nothing to do with technology](/blog/why-tenders-get-rejected-bid-disqualification/). Second, for most tender work you want a signing certificate, and many people buy a combined signing and encryption DSC. On [GeM](https://gem.gov.in/) and most GePNIC eProcurement portals you sign your bid and the portal handles encryption of the price bid, so know which certificate you’re mapping. This sits inside the larger paperwork picture. If you haven’t seen it, [the documents you need for tenders](/blog/documents-required-government-tenders/) covers where the DSC fits alongside PAN, GST, Udyam and the rest. ## Getting one is quick — renewing late is how you lose Getting a Class 3 DSC is straightforward now. You apply through a Certifying Authority or one of its partners, complete video and Aadhaar-based eKYC, pay, and the certificate is downloaded onto a fresh token. Same day or next day in most cases. The token itself is a one-time hardware cost; the certificate on it is what carries a validity, usually one, two or three years. Renewal is where people lose tenders, and it’s the most avoidable loss in this entire game. A DSC doesn’t warn you the way a domain or an insurance policy does. It simply expires, and you find out when you try to sign a bid and the portal refuses you. Renewal isn’t instant either. It’s a fresh eKYC and a fresh download, and if your token is old or its drivers are stale, there’s fiddling involved. So treat the expiry date as a hard calendar event. Note it the day you get the DSC. Renew two or three weeks before, not the night a bid is due. And if your DSC is mapped to your profile on a portal, remember that renewing the certificate often means re-registering or re-mapping the new one — a step people forget until it fails. ## The errors, and how to actually fix them Here’s the part you came for. These are the real bid submission failures on GeM and the [GePNIC-based eProcurement portals](/blog/cppp-eprocurement-portal-guide/), and what each one usually means. One honest caveat first: the exact fix depends on your token brand and your portal, because middleware and Java behaviour differ. Where that matters, I’ll say so. ### DSC or token not detected The most common one. The portal can’t see your certificate even though the token is plugged in. Walk this in order: - Check the token’s own utility is installed and running. Every brand ships middleware (ePass, SafeNet, mToken, Watchdata and so on). If that driver isn’t installed, the browser can’t read the token. This is the single biggest cause. - Open that token utility and confirm the certificate actually appears inside it. If the utility itself shows nothing, the problem is the token or driver, not the portal. - Unplug, try a different USB port — ideally a direct port on the machine rather than a hub. Replug. - Make sure only one token is plugged in. Two DSC tokens at once confuse the selection. ### Java problems and the eProcurement signing applet The classic GePNIC pain. Many eProcurement portals still sign through a Java component. If signing silently does nothing, or you get a Java error: - Install the Java version the portal specifies, not just the latest. Some portals are particular. - Add the portal URL to the Exception Site List inside the Java Control Panel. This is the step that fixes a huge share of “signing does nothing” cases. - Some portals have moved to a local signer utility you run in the background instead of browser Java. If yours has, install that utility and keep it running while you sign. ### Browser compatibility Modern Chrome and Edge dropped the old plugin support some portals were built for. If the signing screen is dead: - Use the browser the portal recommends. Many GePNIC portals work most reliably on a specific configuration, and some still note Internet Explorer mode or a particular Firefox or Chrome setup. Read their help page, not a forum. - Allow popups for the portal. A blocked popup looks exactly like a frozen sign button. - Clear cache, or use a fresh profile, if a previous session is interfering. ### Expired certificate The portal says the certificate is expired or invalid. There’s no clever fix. The DSC is dead, you renew it, you re-map it on the portal, and you’ve lost the time you didn’t budget. See the renewal section above. This is purely a planning failure, never a technical one. ### System time or clock mismatch A signature carries a timestamp, and if your computer’s clock is wrong by enough, the signature is rejected as invalid even with a perfectly good DSC. Set your system date, time and time zone to automatic, sync it, confirm it reads IST correctly, then retry. People overlook this one for hours because the DSC “looks fine”. ### ”Signing failed” A generic message that usually traces to one of the above: wrong Java, missing middleware, or a popup or session that broke mid-sign. Close everything, replug the token, restart the browser, and start the signing step fresh rather than retrying on a half-dead session. ### Token PIN locked Crypto tokens lock after a small number of wrong PIN attempts, often five. Once locked, the certificate is inaccessible and no amount of guessing helps — more guessing can permanently block it. You unlock it with the admin PIN or PUK through the token’s utility, which is exactly why you should know your PIN cold before bid day and never test it under deadline pressure. ### Last-minute upload failure Not strictly a DSC error, but it kills bids the same way. The portal is slow or times out as the deadline approaches, because every other bidder is also submitting in the final ten minutes. The fix is behavioural, not technical: complete your upload and signing well before the close, ideally an hour or more ahead. The portal clock is the only clock that counts, and it doesn’t care that your internet was slow. Start the clock earlier Every fix on this list works when you have hours and fails when you have minutes — and that comes down to how early you knew the tender existed. TrackTender AI-parses government tender PDFs and sends matched tenders to your Telegram or WhatsApp the day they publish, deadline and EMD already extracted, for your states and categories. [Get matched tenders →](/subscribe/) First month ₹30 (about ₹1/day), then ₹300/month. Cancel anytime. ## The pattern under all of it Almost every error above is survivable if you have time, and fatal if you don’t. A “DSC not detected” at 5:50pm is a catastrophe. The same error at 4:00pm is a fifteen-minute driver reinstall. Nothing about the fix changes; only the clock does. The error is rarely the real problem. The real problem is meeting the error with no time to handle it. So do the dull preparation. Test your DSC on the portal days before you submit, not at the deadline. Keep the token middleware and Java current. Know your PIN. Track the expiry. And if you want the full sequence from finding a relevant bid through to a clean submission, [how to apply for a government tender](/blog/how-to-apply-for-government-tender-india/) walks the whole path. The cleanest way to beat a “GePNIC DSC error” is to never meet it at 5:50pm in the first place — and that starts with [how fast you find tenders after they publish](/blog/how-fast-government-tenders-get-missed/). The more runway you have before the deadline, the more these last-minute failures become minor reinstalls instead of lost bids. ## Frequently asked questions What class of DSC do I need for government tenders in India? You need a Class 3 DSC. Class 2 has been discontinued, so Class 3 is the only one that matters now for tender work. Why does my portal say no certificate found even though the token is plugged in? Most often the token's own middleware (ePass, SafeNet, mToken, Watchdata and so on) isn't installed or running, so the browser can't read the token. Confirm the certificate appears inside the token utility, try a direct USB port, and make sure only one token is plugged in. How do I fix the eProcurement Java signing applet doing nothing? Install the exact Java version the portal specifies, then add the portal URL to the Exception Site List in the Java Control Panel — that fixes a large share of silent signing failures. If the portal has moved to a local signer utility, install it and keep it running while you sign. Can a wrong computer clock cause my DSC signature to be rejected? Yes. A signature carries a timestamp, and if your clock is off by enough the signature is rejected as invalid even with a good DSC. Set your date, time and time zone to automatic, sync, confirm it reads IST, then retry. What happens if my token PIN gets locked? Crypto tokens lock after a small number of wrong PIN attempts, often five, and more guessing can permanently block the certificate. You unlock it with the admin PIN or PUK through the token's utility — so know your PIN before bid day. How early should I renew my DSC before a bid? Renew two or three weeks before a bid is due, never the night it closes. Renewal is a fresh eKYC and download, and it often means re-registering or re-mapping the new certificate on the portal. KS Written by Ketul Shah Ketul Shah is the founder of TrackTender and Anekant AI. He works with Indian SMEs that bid on government contracts and writes about GeM, e-procurement and how smaller suppliers can compete and win. [More about TrackTender →](/about/) Keep reading ## More from the blog - [09 May 2026BOQ in tenders: full form, meaning and how to fill itBOQ full form is Bill of Quantities. What it is, how to read one, and how to fill the protected Excel file without getting your financial bid rejected.](/blog/boq-in-tenders-explained/) - [06 May 2026GeM vs CPPP vs state portals: where tenders are publishedA clear map of where Indian government tenders are published, GeM vs CPPP vs state portals, and a realistic way to watch them all without five logins.](/blog/where-government-tenders-come-from/) - [11 June 2026Tender Tiger vs TrackTender: pricing, features, coverageA fair, fact-checked Tender Tiger vs TrackTender comparison for Indian businesses: the strengths of each and which suits your size and workflow.](/blog/tracktender-vs-tender-tiger/) ## Stop reading about tenders. Start winning them. Pick your states and categories and get matching tenders on Telegram and WhatsApp. [Start tracking](/subscribe/)