The Controller of Certifying Authorities (CCA) is the Government of India's regulatory authority responsible for licensing and supervising organisations that issue Digital Signature Certificates in India. It operates under the Ministry of Electronics and Information Technology (MeitY) and performs its functions under the Information Technology Act, 2000.
CCA plays an important role in making digital signatures trustworthy. It establishes the regulatory framework, sets security and technical standards, supervises licensed Certifying Authorities and operates the Root Certifying Authority of India (RCAI), which forms the foundation of India's Public Key Infrastructure.
One important distinction is that CCA does not normally issue Digital Signature Certificates directly to individuals. It licenses Certifying Authorities (CAs), and these licensed organisations issue certificates to individuals and organisations after completing the required verification process.
In this guide, you will understand what CCA is, its legal powers, how it regulates digital signatures, how the India PKI trust system works and where you can obtain a Digital Signature Certificate.
What Is the Controller of Certifying Authorities (CCA)?
The Controller of Certifying Authorities is a statutory regulatory authority appointed by the Central Government under Section 17 of the Information Technology Act, 2000.
The office of CCA came into existence on 1 November 2000. It functions under the Ministry of Electronics and Information Technology and aims to promote the use of digital signatures for secure electronic transactions, e-governance and e-commerce.
CCA regulates the organisations known as Certifying Authorities. These organisations verify applicants and issue Digital Signature Certificates that help authenticate electronic records and signatures.
The authority also establishes technical and security requirements to maintain confidence in India's digital signature ecosystem.
You can read more about its institutional role on the official CCA website.
Under Which Act Does CCA Work?
CCA performs its regulatory functions under the Information Technology Act, 2000. Chapter VI of the Act deals with the regulation of Certifying Authorities and provides the legal foundation for CCA's responsibilities.
The following provisions are particularly important:
| Section | Subject | What it provides |
|---|---|---|
| Section 17 | Appointment of Controller | Provides for the appointment of the Controller of Certifying Authorities and other officers. |
| Section 18 | Functions of Controller | Defines the Controller's regulatory and supervisory functions. |
| Section 19 | Recognition of foreign Certifying Authorities | Provides for recognition of foreign Certifying Authorities, subject to the prescribed conditions. |
| Sections 21–24 | Licensing of Certifying Authorities | Cover licensing requirements, applications and the procedure for granting or rejecting licences. |
| Sections 25–26 | Suspension and revocation of licences | Provide for action against a Certifying Authority's licence on specified grounds. |
| Sections 28–29 | Investigation and access | Provide powers to investigate contraventions and access relevant computer systems and data, subject to the Act. |
| Section 68 | Power to give directions | Allows the Controller to issue directions to a Certifying Authority or its employees in accordance with the law. |
| Section 89 | Power to make regulations | Provides the regulation-making framework, subject to the prescribed requirements. |
You can read the complete provisions in the Information Technology Act, 2000 on India Code.
What Is the Difference Between CCA and a Certifying Authority?
CCA and a Certifying Authority perform different functions. CCA is the regulator, whereas a licensed Certifying Authority provides Digital Signature Certificate services to subscribers.
For example, when an individual applies for a Digital Signature Certificate, the applicant generally approaches a licensed CA. The CA verifies the applicant's identity and follows the applicable certificate issuance procedures.
CCA does not perform this routine subscriber-level issuance process. Instead, it licenses and supervises the CA and establishes the standards under which the CA operates.
| Basis | CCA | Certifying Authority (CA) |
|---|---|---|
| Nature | Government regulatory authority | Licensed certificate service provider |
| Main responsibility | Licensing, regulation and supervision | Verification and issuance of subscriber certificates |
| Legal basis | Information Technology Act, 2000 | Licence granted under Section 21 of the IT Act |
| Who it serves | Regulates Certifying Authorities and supports the India PKI framework | Individuals, organisations and relying parties |
| Certificate-related role | Certifies the public keys of licensed CAs through RCAI | Issues and manages Digital Signature Certificates for subscribers |
CCA also clarifies this distinction in its official Frequently Asked Questions.
What Is a Digital Signature Certificate (DSC)?
A Digital Signature Certificate (DSC) is an electronic certificate that establishes a link between a subscriber's identity and the public key associated with that subscriber. It supports authentication and verification of digital signatures.
In simple terms, a DSC helps establish who signed an electronic record and whether the signed information has been altered after signing, subject to proper signature validation.
Digital signatures use cryptographic technology involving a public key and a private key:
- Private key: The subscriber uses the private key to create a digital signature. It must remain securely controlled.
- Public key: The corresponding public key helps verify the digital signature.
- Digital Signature Certificate: The certificate links the public key with the verified identity of the subscriber.
For example, when a person digitally signs an electronic document, the signature can be checked using the corresponding public key and certificate. This helps the recipient verify the signature and detect changes to the signed information.
The Information Technology Act recognises electronic signatures under Section 3A and provides legal recognition to electronic signatures under Section 5, subject to the applicable legal requirements.
Read the relevant provisions in the Information Technology Act, 2000.
What Is India PKI and How Does CCA Support It?
India PKI stands for India Public Key Infrastructure. It is the trust framework under which Digital Signature Certificates and related public key certificates are issued and validated in India.
India PKI follows a hierarchical structure. At the top is the Root Certifying Authority of India (RCAI), followed by Certifying Authorities licensed by CCA. These CAs issue certificates to subscribers under the applicable certificate policies.
The main participants in this framework are:
- CCA: Regulates and supervises licensed Certifying Authorities.
- RCAI: Provides the root of trust and certifies the public keys of licensed CAs.
- Certifying Authorities: Verify applicants and issue subscriber certificates.
- Subscribers: Individuals or organisations that hold and use Digital Signature Certificates.
- Relying parties: People or organisations that receive signed documents and verify the associated certificates and signatures.
CCA's India PKI policies and certificate information explain the hierarchical trust framework and the role of different participants.
What Is the Root Certifying Authority of India (RCAI)?
The Root Certifying Authority of India (RCAI) is the highest level of certification in India's PKI hierarchy. CCA established RCAI under Section 18(b) of the Information Technology Act, 2000.
RCAI certifies the public keys of licensed Certifying Authorities. This creates a trust relationship between the root certificate and the certificates issued by licensed CAs.
When a relying party validates a subscriber's certificate, the verification process can follow the certificate chain back to the trusted root. This helps establish whether the certificate belongs to the recognised India PKI hierarchy.
RCAI also publishes certificate revocation information for certificates issued at the root level. These records help applications identify certificates that should no longer be trusted.
It is important to distinguish between the two levels:
- RCAI: Certifies the public keys of licensed Certifying Authorities.
- Licensed CAs: Issue and manage Digital Signature Certificates for individual and organisational subscribers.
CCA explains the operation of RCAI in its official organisational and functions disclosure.
What Are the Main Functions of the Controller of Certifying Authorities?
Section 18 of the Information Technology Act, 2000 defines the functions of the Controller. These responsibilities cover licensing, supervision, technical standards, security, certificate policies and the relationship between Certifying Authorities and subscribers.
1. Licensing Certifying Authorities
One of CCA's primary functions is to grant licences to organisations that want to operate as Certifying Authorities in India.
An applicant must meet the requirements prescribed under the IT Act and applicable licensing guidelines. The assessment may cover financial and organisational eligibility, technical infrastructure, security arrangements, operational procedures and supporting audit reports.
CCA examines the application and relevant supporting information before deciding whether to grant a licence.
The CA Licensing Guidelines explain the requirements and procedures for organisations seeking to become licensed Certifying Authorities.
2. Supervising Licensed Certifying Authorities
CCA's responsibility does not end after granting a licence. It also supervises the activities of licensed Certifying Authorities to ensure that they continue to follow the applicable laws, regulations, policies and security requirements.
This supervision helps maintain confidence in certificate issuance, identity verification, private-key management and other essential CA operations.
Licensed CAs must follow their approved Certification Practice Statements and other applicable requirements while providing services to subscribers.
3. Certifying the Public Keys of Licensed CAs
CCA performs an important technical function through RCAI by certifying the public keys of licensed Certifying Authorities.
This process establishes the trust relationship between the root certificate and the licensed CA certificates. It allows relying parties to verify whether a CA's certificate belongs to the recognised India PKI hierarchy.
This root-level certification is different from issuing a Digital Signature Certificate to an individual subscriber.
4. Establishing Technical and Security Standards
CCA specifies technical and security standards that Certifying Authorities must follow. These requirements help ensure consistency and reliability across the India PKI framework.
They cover areas such as certificate formats, cryptographic systems, identity verification, key management, interoperability, infrastructure security and certificate lifecycle management.
CCA periodically updates its technical requirements to address changes in technology and security practices.
5. Prescribing Identity Verification Requirements
Identity verification is an essential part of issuing a Digital Signature Certificate. Before issuing a certificate, the Certifying Authority must establish the identity of the applicant through the permitted verification process.
CCA publishes Identity Verification Guidelines that explain the requirements applicable to different types of applicants and verification methods.
The Identity Verification Guidelines help maintain a consistent assurance framework across licensed CAs.
6. Prescribing the Duties and Qualifications of CA Personnel
CCA also specifies requirements relating to the qualifications and experience of employees working for Certifying Authorities.
These requirements help ensure that people responsible for sensitive operations, certificate issuance and security management have appropriate knowledge and competence.
7. Reviewing Certification Practice Statements
A Certification Practice Statement (CPS) explains how a Certifying Authority performs its certificate-related activities.
It describes procedures for applications, identity verification, certificate issuance, renewal, suspension, revocation, validation and other operational responsibilities.
CCA reviews the relevant certification practices as part of its regulatory framework. This helps ensure that a CA's actual procedures remain consistent with the applicable policies and requirements.
8. Conducting and Requiring Compliance Audits
Audits help determine whether a Certifying Authority follows the required security and operational practices.
CCA publishes audit criteria covering important areas such as:
- Physical and environmental security.
- Cryptographic key generation, storage and management.
- Identity verification and certificate issuance.
- Access controls and operational security.
- Certificate renewal, suspension and revocation.
- Business continuity and disaster recovery arrangements.
- Record maintenance and compliance documentation.
The Audit Criteria for Certifying Authorities provide the framework for examining these areas.
9. Resolving Conflicts Between CAs and Subscribers
CCA's statutory functions also include specifying how Certifying Authorities should deal with subscribers and resolving conflicts of interest between CAs and subscribers.
This responsibility supports a fairer relationship between certificate providers and the individuals or organisations using their services.
10. Maintaining Public Disclosure Information
CCA maintains a database containing disclosure records of Certifying Authorities. The purpose is to make specified information about licensed CAs accessible to the public.
This supports transparency and helps subscribers and relying parties understand the regulatory status and relevant practices of certificate providers.
What Powers Does CCA Have Under the IT Act?
In addition to its general functions, the Information Technology Act gives CCA specific legal powers to regulate Certifying Authorities and take action when they fail to comply with the applicable requirements.
Granting or Rejecting CA Licence Applications
Under Sections 21 to 24, CCA regulates the licensing of Certifying Authorities. It examines applications and may grant or reject a licence after following the prescribed procedure.
Suspending or Revoking a CA Licence
Section 25 provides for suspension or revocation of a Certifying Authority's licence on specified grounds.
For example, action may be taken where the CA has made a material misrepresentation, failed to comply with licence conditions or contravened the requirements of the Act or applicable regulations.
The law also provides procedural safeguards, including the applicable opportunity to be heard.
Suspension or revocation of a CA's licence is different from suspension or revocation of an individual subscriber's Digital Signature Certificate. The two actions concern different levels of the certificate framework.
Investigating Contraventions
Section 28 gives the Controller powers to investigate contraventions of the Act or rules and regulations made under it, subject to the conditions in the provision.
Section 29 provides for access to relevant computer systems and data in connection with an investigation, subject to the statutory requirements.
Issuing Directions to Certifying Authorities
Section 68 allows the Controller to issue directions to a Certifying Authority or its employees where necessary to ensure compliance with the Act and applicable rules and regulations.
These directions may require an organisation to take specified measures or stop an activity that is inconsistent with its legal obligations.
Making Regulations
Section 89 provides the legal framework for making regulations concerning matters covered by the Act. The regulation-making process is subject to the requirements prescribed in the provision, including the applicable Central Government approval and Gazette notification procedures.
What Is the Difference Between a Digital Signature and an Electronic Signature?
People often use the terms digital signature and electronic signature interchangeably. However, the Information Technology Act distinguishes between them.
A digital signature is a specific form of electronic authentication that uses an asymmetric cryptosystem and hash function, as described under Section 3 of the IT Act.
An electronic signature is a broader legal category under Section 3A. It covers an electronic authentication technique specified in the Second Schedule of the Act, subject to the applicable requirements.
| Basis | Digital Signature | Electronic Signature |
|---|---|---|
| Legal provision | Section 3 | Section 3A |
| Nature | A specific cryptographic method of authentication | A broader category of legally recognised electronic authentication techniques |
| Technology | Uses asymmetric cryptography and a hash function | Uses a technique specified under the applicable legal framework |
| Regulatory framework | India PKI and the CCA-regulated certificate ecosystem | Depends on the electronic authentication method and applicable legal requirements |
A Digital Signature Certificate is therefore part of a specific certificate-based digital signature framework. Not every electronic signature method requires a subscriber to obtain a conventional DSC.
How Does CCA Regulate eSign Services?
eSign is an electronic signature service that allows individuals to sign documents digitally through an online process. It provides a way to authenticate electronic documents without requiring every user to independently manage a traditional physical signing token.
Under the India PKI framework, eSign services operate through licensed Certifying Authorities and empanelled eSign Service Providers (ESPs), subject to the applicable requirements.
CCA provides the regulatory and technical framework for these services. The service providers facilitate the actual signing process through their systems and integration arrangements.
Application owners that want to enable eSign in their platforms can refer to the official CCA service information for the relevant framework and provider details.
What Is Time Stamping in Digital Signature Services?
Time stamping is a service that helps establish the time associated with a digital document, transaction, certificate or other electronic reference.
It can be useful when an organisation needs evidence of when a particular electronic record existed or when a digital signature was created.
CCA regulates time stamping services under the India PKI framework, while licensed Certifying Authorities facilitate and operate the services.
These services use a designated time source and cryptographic mechanisms to generate verifiable time stamps. The applicable framework also requires appropriate security, operational controls and compliance arrangements.
For more information, read the official CCA explanation of Time Stamping Services.
What Are the Latest CCA Guidelines and Security Requirements?
CCA periodically updates its guidelines to maintain the security, reliability and interoperability of India's digital signature framework.
As listed on the official guidelines page reviewed on 10 November 2026, some important updates include:
| Guideline | Latest listed version | Date |
|---|---|---|
| DSC Interoperability Guidelines | Version 4.1 | 16 June 2026 |
| Identity Verification Guidelines | Version 2.6 | 16 June 2026 |
| Security Requirements for Crypto Devices | Version 2.4 | 14 August 2026 |
| CA Licensing Guidelines | Version 2.2 | 9 September 2025 |
| Audit Criteria for Certifying Authorities | Version 1.7 | 9 September 2025 |
These guidelines address different parts of the digital signature ecosystem. For example:
- Interoperability Guidelines: Help ensure that certificates issued by different licensed CAs can work within the common India PKI framework.
- Identity Verification Guidelines: Establish requirements for verifying the identity of certificate applicants.
- Crypto Device Security Requirements: Set security requirements for cryptographic devices used in certificate-related operations.
- CA Licensing Guidelines: Explain the requirements for organisations seeking a licence to operate as a Certifying Authority.
- Audit Criteria: Provide a framework for examining whether CAs follow the prescribed security and operational practices.
You can check the complete and latest documents on the official CCA guidelines page.
How Can You Get a Digital Signature Certificate in India?
Individuals and organisations that need a Digital Signature Certificate must approach a Certifying Authority licensed by CCA.
The general process is as follows:
- Choose a licensed CA: Visit the CCA website and check the current list of licensed Certifying Authorities.
- Select the appropriate certificate: Identify the certificate suitable for your intended use, such as individual or organisational signing.
- Submit the application: Apply through the selected CA or its authorised application process.
- Complete identity verification: Provide the required information and documents under the applicable identity verification procedure.
- Complete payment and other requirements: Follow the CA's application and service requirements.
- Receive the certificate: After successful verification and approval, the CA issues the Digital Signature Certificate through the permitted process.
- Use the certificate securely: Protect the private key and follow the CA's instructions for signing and certificate management.
The actual application process, charges, validity period and delivery method may vary depending on the selected CA and certificate type.
You can check the official list of active CA services and the CCA guidance on obtaining India PKI services.
How Can You Verify a Digital Signature Certificate?
Receiving a digitally signed document does not mean you should ignore certificate verification. A relying party should check whether the certificate and signature are valid for the relevant purpose.
Some important checks include:
- Certificate issuer: Check which Certifying Authority issued the certificate.
- Certificate validity: Confirm whether the certificate was valid at the relevant time.
- Certificate status: Check whether the certificate has been revoked or suspended, as applicable.
- Certificate chain: Verify that the certificate chain leads to a trusted root under the relevant trust framework.
- Signature integrity: Confirm that the signed document has not been altered after signing.
- Signer information: Check the identity and certificate details associated with the signature.
CCA publishes root certificate and revocation-related information that supports the India PKI validation framework. Its official FAQs explain how users can obtain root certificate information and Certificate Revocation Lists.
Remember that a valid digital signature establishes important facts about authentication and document integrity. It does not automatically prove that every statement in the signed document is true or legally correct.
What Are the Responsibilities of a Digital Signature Certificate Holder?
A subscriber also has responsibilities under the Information Technology Act. Obtaining a DSC does not remove the need to protect the signing credentials.
Some important precautions include:
- Keep the private key and cryptographic token secure.
- Do not share the private key or signing credentials with unauthorised people.
- Use the certificate only for the permitted and intended purpose.
- Inform the issuing CA if the private key is compromised or its security is in doubt.
- Follow the applicable procedure for suspension or revocation when necessary.
- Check certificate validity before using it for important transactions.
Section 42 of the IT Act deals with control of private keys and the responsibilities of subscribers. Proper protection of the private key is essential because anyone who gains unauthorised control over it may be able to misuse the associated signing credentials.
What Are the Limits of CCA's Role?
CCA is responsible for regulating the Certifying Authority and India PKI ecosystem. It does not perform every activity connected with electronic documents, digital fraud or online security.
- CCA does not issue ordinary subscriber DSCs directly: Individuals and organisations generally obtain certificates from licensed Certifying Authorities.
- CCA does not guarantee the truth of signed documents: A valid signature helps establish authentication and integrity, not the truth of every statement in the document.
- CCA does not replace cybercrime police: General online fraud, hacking and other criminal complaints must be reported through the appropriate law enforcement channels.
- CCA does not remove subscriber responsibilities: Certificate holders must protect their private keys and follow the applicable security requirements.
- CCA's regulatory role is specialised: Its primary responsibilities concern Certifying Authorities, digital signature certificates and related trust services under the IT Act.
For issues involving cybersecurity incidents and technical response, you can also read our guide on CERT-In and India's cybersecurity incident response framework.
Frequently Asked Questions About CCA and Digital Signatures
Q. What is the full form of CCA?
Ans. CCA stands for Controller of Certifying Authorities. It is the regulatory authority responsible for licensing and supervising Certifying Authorities under the Information Technology Act, 2000.
Q. Under which section of the IT Act is CCA appointed?
Ans. Section 17 of the Information Technology Act, 2000 provides for the appointment of the Controller of Certifying Authorities by the Central Government.
Q. When did the office of CCA come into existence?
Ans. The office of the Controller of Certifying Authorities came into existence on 1 November 2000.
Q. Under which ministry does CCA work?
Ans. CCA functions under the Ministry of Electronics and Information Technology (MeitY), Government of India.
Q. Does CCA issue Digital Signature Certificates to individuals?
Ans. No. CCA licenses and supervises Certifying Authorities. Individuals and organisations generally obtain their Digital Signature Certificates from a licensed CA after completing the required verification process.
Q. What is the difference between CCA and a Certifying Authority?
Ans. CCA is the regulator that grants licences and supervises Certifying Authorities. A licensed CA verifies applicants and issues Digital Signature Certificates to subscribers.
Q. What is the Root Certifying Authority of India?
Ans. The Root Certifying Authority of India (RCAI) is the highest level of certification in the India PKI hierarchy. It certifies the public keys of licensed Certifying Authorities and provides the root of trust for the certificate chain.
Q. What is India PKI?
Ans. India PKI stands for India Public Key Infrastructure. It is the hierarchical trust framework that supports the issuance and validation of Digital Signature Certificates and related public key certificates in India.
Q. Which section of the IT Act defines the functions of CCA?
Ans. Section 18 of the Information Technology Act, 2000 defines the functions of the Controller of Certifying Authorities.
Q. Can CCA suspend or revoke a Certifying Authority's licence?
Ans. Yes. Section 25 of the IT Act provides for suspension or revocation of a Certifying Authority's licence on specified grounds and subject to the applicable legal procedure.
Q. What is the difference between a digital signature and an electronic signature?
Ans. A digital signature is a specific cryptographic authentication method under Section 3 of the IT Act. An electronic signature is a broader category under Section 3A that includes legally recognised electronic authentication techniques specified under the Act.
Q. Can a digitally signed document still contain false information?
Ans. Yes. A digital signature helps verify the signer and detect changes to signed information. It does not guarantee that every statement in the document is factually true.
Q. How can I obtain a Digital Signature Certificate in India?
Ans. You can obtain a Digital Signature Certificate by applying to a Certifying Authority licensed by CCA. Check the official CCA website for the current list of licensed CAs and follow the selected provider's application and identity verification process.
Q. What is the role of CCA in eSign services?
Ans. CCA provides the regulatory and technical framework for eSign services under India PKI. Licensed Certifying Authorities and empanelled eSign Service Providers facilitate the actual service for users and application owners.
Conclusion
The Controller of Certifying Authorities plays a central role in regulating India's digital signature ecosystem. Appointed under Section 17 of the Information Technology Act, 2000, CCA licenses and supervises Certifying Authorities, establishes technical standards, certifies CA public keys through RCAI and supports the security and interoperability of India PKI.
Its role is different from that of a Certifying Authority. CCA regulates the certificate providers, while licensed CAs verify applicants and issue Digital Signature Certificates to individuals and organisations.
By maintaining licensing requirements, identity verification standards, security guidelines and compliance audits, CCA helps create a trusted foundation for digital signatures, eSign services and secure electronic transactions in India.