GSTN Introduces emSigner v3.3 for New DSC Tokens Issued from 21 September 2026

GSTN has issued an advisory regarding emSigner Version 3.3 for taxpayers and tax officers using Digital Signature Certificates (DSCs) on the GST Portal. The new version has been introduced mainly to support the new DSC USB tokens/dongles issued on or after 21 September 2026.

1. Existing DSC users – no immediate change

If your existing DSC certificate and USB token are valid and are working properly as on 21 September 2026, you do not need to change or upgrade emSigner immediately. You can continue using your existing version.

However, you should upgrade to emSigner v3.3 if:

• DSC signing fails on the GST Portal; or
• your DSC certificate does not appear for selection even though the correct token driver is installed.
• The new emSigner v3.3 is backward compatible, so it can also work with existing/older valid DSC tokens.

2. New DSC / new USB dongle from 21 September 2026

If a new USB token/dongle is issued on or after 21 September 2026, emSigner v3.3 will be required. This includes:

• a completely new DSC with a new dongle; or
• renewal of an existing DSC where the renewed certificate is provided in a new dongle.
• For such newly issued dongles, older versions of emSigner will not work. Therefore, emSigner Version 3.3 must be installed.

3. Minimum system requirements for emSigner v3.3

Before installing Version 3.3, the computer used for GST DSC signing should meet these requirements:

• The advisory specifies support for Internet Explorer 10+, Firefox 6+, Chrome 16+, Safari 6+, Opera 12.1+ and Microsoft Edge.

4. What happens to existing FIPS 140-2 DSC dongles?

• This is an important clarification. 21 September 2026 does not automatically invalidate existing DSCs.
• As per the Controller of Certifying Authorities (CCA), a DSC downloaded on a FIPS 140-2 dongle on or before 21 September 2026 can continue to be used until that DSC expires.
• Therefore, taxpayers are not required to replace a working existing DSC merely because 21 September 2026 has arrived.

5. Renewal / fresh DSC after the transition

• CCA has advised Certifying Authorities to stop issuing DSCs in FIPS 140-2 modules by 21 September 2026.
• Accordingly, after the existing DSC expires, the FIPS 140-2 dongle generally cannot be used for renewal or for downloading a fresh DSC. Fresh issuance/renewal will generally require a FIPS 140-3 compliant dongle.

Existing valid FIPS 140-2 DSC → Continue till expiry
Fresh DSC / normal renewal thereafter → Generally FIPS 140-3 dongle

6. Important exception for existing active DSC

CCA has also provided an exception. Where an active DSC needs to be re-issued to the same user, the Certifying Authority may, after following the prescribed procedure, re-issue the DSC on a FIPS 140-2 module once, on or after 21 September 2026, only for the remaining validity period of that DSC and without charging the user.

7. Overall FIPS migration timeline

• FIPS 140-3 has replaced FIPS 140-2 for new cryptographic module validations. CCA’s objective is to completely retire or replace outdated/non-compliant cryptographic components by 21 September 2029. It also states that no further updates for FIPS 140-2 will be available after 21 September 2026.
• A limited exception exists for certain Government organisations, which may continue using FIPS 140-2 modules up to 21 September 2029 after appropriate risk assessment, approval from the concerned Ministry and prescribed risk/compliance waiver procedures.
• CCA has also advised OEMs/distributors to publish their buy-back or exchange policy for replacing FIPS 140-2 modules with FIPS 140-3 modules, and Certifying Authorities to communicate their pricing/exchange arrangements.

Advisory_on_Migration_from_FIPS_140-2_to_FIPS_140-3