DSC Bridge

A free, open-source localhost proxy that lets you use your USB Digital Signature Certificate (DSC) on Indian government e-filing portals — without paying for proprietary signing software.

The problem

Indian govt portals (IP India, MCA, etc.) send signing requests to http://127.0.0.1:1620 using the nSign XML protocol. Commercial signing software in the market that listens on this port typically requires a paid licence key. Free alternatives (such as eMudhra emBridge) run on different ports and use an incompatible protocol, so they do not work with these portals out of the box.

DSC Bridge implements the nSign protocol directly on port 1620 using Windows' built-in CryptoAPI, so it works with any USB token that registers its certificate in the Windows Certificate Store via a CSP driver.

Requirements

• Windows 10 or 11
• Your USB DSC token inserted and its driver installed (the certificate must appear in Windows Certificate Manager → Personal)
• PowerShell 5.1 (built into Windows — no install needed)
• Run as Administrator (required to register the HTTP.sys URL reservation on port 1620)

Tested tokens

• Watchdata ProxKey (PRoXKey CSP India) with e-Mudhra Class 3 Individual DSC

Other tokens that install a Windows CSP driver and register the cert in the MY store should work — open an issue if yours doesn't.

Usage

Prerequisite — download your DSC to the token

Before using DSC Bridge, your certificate must be downloaded onto your USB token using the emClick tool (provided by your CA / DSC vendor):

1. Insert your USB DSC token.
2. Open emClick and enter your Application ID and Challenge Code (from your CA's issuance email or portal).
3. emClick downloads the certificate onto the token and registers it in the Windows Certificate Store.
4. Verify: open certmgr.msc → Personal → Certificates — your DSC should appear with a small key icon.

You only need to do this once per token.

Using the bridge

1. Insert your USB DSC token.
2. Double-click Start-DSC-Bridge.bat and approve the UAC prompt.
3. A PowerShell window opens showing DSC Bridge | http://127.0.0.1:1620/ | Ctrl+C to stop.
4. Go to the government portal and click "Add Digital Signature" (or equivalent).
5. The bridge reads your certificate and the form fields (Serial No., Holder Name, Expiry Date) are populated automatically.
6. To sign a document (e.g. "DSC Sign" on a form-submission page), click the sign button. The bridge embeds a digital signature into the PDF and your token prompts for its PIN. The first time you sign, the bridge downloads its PDF-signing libraries (~6 MB, one time) — this needs an internet connection.
7. Fill in the rest of the form and submit. Close the PowerShell window when done.

Supported portals

Any portal that uses the nSign XML protocol on port 1620. Confirmed working:

• IP India Trademark e-Filing (ipindiaonline.gov.in) — both new-user registration (reading the certificate) and document signing (DSC Sign)

Likely compatible (same protocol, untested):

• MCA21 (mca.gov.in)
• eProcurement portals on nic.in

Open an issue or PR if you test another portal.

Security notes

Run only while actively filing. The bridge listens on 127.0.0.1:1620. Any process on your machine can reach that port while it is open.

The following mitigations are in place:

• Origin allowlist — only requests from *.gov.in and *.nic.in origins receive a permissive CORS response. Requests from other websites (including malicious pages open in other tabs) receive Access-Control-Allow-Origin: null and are blocked by the browser's CORS policy.
• Localhost only — the listener is bound to 127.0.0.1, not 0.0.0.0. The port is not reachable from other machines on your network.
• No persistent process — the bridge does not install a service or run at startup. It runs only when you launch it manually.

How it works

The nSign XML protocol works like this:

1. The portal JavaScript POSTs an XML request to http://127.0.0.1:1620.
2. For pkiNetworkCertExt (reading the certificate): the bridge reads matching certificates from the Windows Certificate Store, builds an inner XML with the holder's CN, serial number, expiry date, CA name, and DER certificate, base64-encodes it, and returns it in a <data> element.
3. For pkiNetworkSign (signing a document): the request carries a base64 PDF and a <pdf> block describing where to place the visible signature (page, coordinates, reason, location). The bridge locates the signing certificate by serial number, embeds a detached PKCS#7 / CMS signature (SHA-256) into the PDF — computing the signature with the token's private key, which never leaves the token — and returns the complete signed PDF, base64-encoded, in a <data> element.

The signing request prompts your token for its PIN. PDF signing is performed with iTextSharp + BouncyCastle, downloaded from NuGet to a local lib\ folder the first time you sign.

Files

File	Purpose
dsc-bridge.ps1	The bridge server
Start-DSC-Bridge.bat	Launcher — runs the script elevated via UAC

Troubleshooting

"Certificate read failed" on the portal

• Make sure the token is inserted before launching the bridge.
• Open certmgr.msc → Personal → Certificates and confirm your DSC appears there with a key icon.
• Check the PowerShell window for error output.

"Cannot bind to http://127.0.0.1:1620/" — run as Administrator

• The bat file should handle this. If you ran the .ps1 directly, right-click → Run as Administrator.

Port 1620 already in use

• Another signing tool may already be running on port 1620. Stop it first, then launch the bridge.

Licence

MIT