DSC Not Working: emSigner, emBridge and USB Token Errors Fixed (2026)

Why a DSC stops working on MCA, GST, income tax and other portals

Every government portal runs its own signing stack, and most DSC problems are really a mismatch between what a portal expects and what is actually installed or registered. Those four root causes show up as six recognisable patterns:

• Wrong or incomplete signing utility for that portal. MCA V3 needs both emSigner AND emBridge installed and running at the same time — one alone is not enough. GST’s own tutorial names emSigner specifically as “mandatory for using DSC on the GST Portal.” TRACES uses a distinct “Web-Socket emsigner” / “TRACES WebSigner” build that needs a 32-bit JRE 8 even on 64-bit Windows. DGFT’s own troubleshooting centres on emBridge, not emSigner.
• Certificate not registered — or registered to the wrong ID — on that specific portal. This is where most of the exact error text shows up: “The DSC that you are trying to register is already used in the system,” “The DSC is already registered with another user,” “The DSC you are trying to affix is not registered at the portal,” and (on the income-tax portal) “DSC already registered” against a different PAN.
• PAN, name or DOB mismatch between the certificate and the portal record. Shows up as “digital signature certificate credentials are invalid due to PAN mismatch,” “The PAN mentioned in the Digital Signature Certificate does not match. Please retry,” or GST’s “PAN No verification failed, Please select the valid certificate to sign.”
• Blocked or misconfigured localhost connection. emSigner runs as a local background service the browser reaches over HTTPS, normally at 127.0.0.1:1585. “Failed to establish connection to the server. Kindly restart the Emsigner” usually means the service isn’t running as Administrator, the browser hasn’t been given a security exception for that address, antivirus/firewall software is blocking the port thinking it’s a threat, or a stale install has it listening on a different port (2015 and 8080 are both common substitutes).
• USB token driver or detection failure. “Digital Signature Certificate Missing. Please plugin the token & click on process,” “DSC token not found,” “Unable to find slot / No slot with a token was found,” and DSC-not-detected messages on Windows 11 are all, in the great majority of cases, a driver problem: the token isn’t seated in a direct port, another program is holding it open, or a generic (non-vendor) driver installed the PKCS#11 module without properly registering the Windows CSP that makes the certificate visible to signing tools in the first place.
• Expired, revoked, or wrongly classed certificate. “DSC invalid / DSC showing invalid” most often means an expired or revoked certificate, or — specifically on GST — a certificate whose Key Usage attribute reads “Key Encipherment” instead of the required “Digital Signature, Non-Repudiation.” “Selected certificate is not a PAN based certificate” means an organisation-only DSC was chosen where GST requires a PAN-based Class 2 or Class 3 certificate.

How to fix each DSC and emSigner error

• Confirm your account type on MCA V3 before anything else. Only Business Users can register or associate a DSC — a Registered User account cannot, full stop. Upgrade to a Business User account through the portal's Profile Upgrade page first; the full flow is in the MCA V3 portal problems guide.
• Reinstall, don’t repair, when the signing utility itself won’t start. MCA’s own guidance for a failed emSigner/emBridge is a clean uninstall of both applications, a fresh reinstall, and launching them as Administrator (right-click → Run as administrator) — not a repair install.
• Fix the localhost/port block on GST. Start emSigner as Administrator, then in the browser add https://127.0.0.1:1585 as a trusted security exception (Firefox: Advanced → Add Exception → Confirm Security Exception). If the error persists, check whether antivirus or a firewall rule is blocking that port, and confirm nothing else on the machine is holding port 1585 — a port conflict is the usual reason emSigner ends up listening on 2015 or 8080 instead.
• Fix a ‘DSC already registered with another user’ or ‘already used in the system’ error on MCA V3 by logging in as the user ID the DSC is currently tied to and dissociating it there first, or by using a different DSC for the new user ID — a single certificate can only be associated with one MCA user ID at a time.
• Fix a PAN-mismatch rejection on GST, income tax, TRACES or DGFT by re-selecting the certificate that actually matches the PAN of the authorised signatory logged in to sign. If the certificate itself carries the wrong PAN, it cannot be edited — the PAN is cryptographically embedded at issuance, so the only remedy is a fresh DSC reissued by the Certifying Authority against corrected KYC.
• Fix TRACES’ ‘DSC verification failed’ or ‘Error occurred while DSC registration’ by uninstalling every Java version and the old Web-Socket emsigner, installing only a 32-bit JRE 8 (even on a 64-bit machine, and with no other Java version present), installing the current Web-Socket emsigner V2.0, and retrying. If it still fails, email contactus@tdscpc.gov.in rather than repeating the reinstall.
• Fix a token that won’t detect by reseating it in a direct USB port (skip hubs), closing any other application or browser tab that might already have an exclusive session with it, and confirming it shows up correctly in the token vendor’s own management utility — that’s the proof the CSP registered correctly, not just that the OS sees a USB device.
• Check what Windows actually has registered before assuming the certificate is broken. Run certmgr.msc (Windows key + R) for the current user’s Personal → Certificates store, or add the Certificates snap-in via mmc.exe scoped to ‘Computer account’ for the machine-wide store. Double-clicking the certificate shows its validity dates and Certification Path status — useful for telling an expired certificate apart from one that’s simply never been associated with the portal.

USB token driver problems, whatever the brand

The failure mode is the same across every token brand, which is exactly why it gets misdiagnosed as a DSC problem rather than a driver problem: a USB token’s driver install has to register two separate things on Windows — a PKCS#11 library and a CSP (Cryptographic Service Provider). It is the CSP registration that actually makes the certificate visible to the Windows certificate store and to browsers or signing utilities. A driver that installs only the PKCS#11 module without properly registering the CSP leaves the token effectively invisible to portal signing tools, even though Device Manager shows it connected fine.

A generic or third-party PKCS#11 driver stack can also fail silently when its function version doesn’t match what the signing utility expects — for example, a driver exposing older v2.20 functions against a caller hard-coded for v2.40. That surfaces as a signing error on the portal, not a driver-install error, so it reads as “the DSC is broken” when the actual fault is the generic driver.

Whichever brand the token is — WatchData’s ProxKey being a common one — the reliable fix is the same: install the current driver from that vendor’s own site, run the installer as Administrator, and confirm the token appears correctly in the vendor’s own token-management tool before trying to sign on any portal. If the vendor tool doesn’t see it either, the fault is the driver or the port, not the portal.

Which signing utility your portal actually needs

Reusing a signing utility across the wrong portal is a common trap: installing only emSigner and expecting MCA V3 to work, or only emBridge and expecting GST to work, both fail for the same underlying reason — the portal simply never talks to that utility.

Class 2 to Class 3: the DSC change that still catches filers out

Looks like a DSC problem but isn’t

• “This application requires a Java Runtime Environment 1.6.0” on GST looks like a Java compatibility fault, but is usually just an outdated emSigner installer — current emSigner releases largely bundle their own runtime, so downloading the current installer from the portal’s Download page fixes it, not installing an old-style JRE.
• A frozen, silent ‘Associate DSC’ screen on MCA V3 looks like a portal outage, but the most common cause is a still-default token PIN on a first-time token. Change the PIN in the token’s management utility and refresh before assuming the portal itself is down.
• ‘Digital signature certificate credentials are invalid due to PAN mismatch’ looks like a document problem, but it is a certificate-identity problem — the PAN embedded in the DSC at issuance simply doesn’t equal the PAN of the signatory role selected. It cannot be corrected in the portal or by the CA editing the file; only a fresh reissue fixes it.
• An expired DSC, a revoked DSC, and a DSC that’s simply never been associated with a given portal all throw the same generic ‘invalid’ or ‘not registered’ signing error to the filer. They are different problems with different fixes — revocation is a deliberate action a Certifying Authority takes before natural expiry (for compromise, fraud, or on the subscriber’s own request), while expiry just happens on schedule. Check the actual status in certmgr.msc before assuming which one applies.
• Two edge-case portals are worth flagging as unconfirmed rather than guessed at: Udyam Registration appears to authenticate via Aadhaar-linked OTP rather than DSC in its standard flow, and GST e-invoicing (the Invoice Registration Portal) appears to sign the validated invoice JSON itself rather than requiring the taxpayer’s own DSC — unlike GST return filing, which does need your registered DSC. Both are based on the absence of DSC-specific official guidance rather than a direct statement to that effect, so treat them as likely rather than certain.

How to escalate when the self-fixes don’t work

• GST: call the GST helpdesk on 1800-103-4786 for a persistent DSC/emSigner error, with a screenshot of the exact error ready.
• Income Tax e-filing: for PAN-mismatch or company-DSC issues that survive the standard fixes, contact the e-filing helpdesk at efilinghelpdesk@incometaxindia.gov.in.
• TRACES/TDS: for a ‘DSC verification failed’ or registration error that survives the Java/WebSigner reinstall, email contactus@tdscpc.gov.in rather than repeating the reinstall a third time.
• MCA V3: raise a service-request/grievance on the portal itself, citing the SRN of the pending filing — this is the route MCA points to specifically when a director’s registered email and mobile are both inactive and blocking DSC re-registration. The full MCA escalation path, including the CRC email for name-reservation tickets, is in the MCA V3 portal problems guide.

None of these routes can guarantee a fix works or that a rejected filing gets approved — that decision sits with the portal or authority, not with any workaround here.

Primary sources

The dates and fees on this page are read off the statute and the statutes and official portals cited, not copied from other guides. You can check every one of them:

• MCA V3 DSC Association FAQs (official MCA FAQ text, relayed)
• GST Portal official tutorial: Register/Update DSC
• GST Portal official tutorial: Troubleshoot DSC Issues
• Income Tax Department: Register Digital Signature Certificate FAQ
• TDS TRACES (TDSCPC): Possible Solutions for DSC FAQ
• CCA: Licensed Certifying Authorities list