USB token reuse for DSC renewal depends on more than whether the device still connects to your computer. The certificate already inside it, the token's exact model and version, and the issuing Certifying Authority's current requirements all matter.
Before choosing a renewal without a new token, check eligibility for the intended certificate download. This helps you order the right combination of certificate and hardware, especially when you are working towards a filing or tender deadline.
A USB crypto token and the DSC held on it have different roles. Treat the following as separate checks:
| Question | What to establish |
|---|---|
| Can I use my existing certificate? | Its current validity/status and suitability for the intended application |
| Can this token receive another certificate? | Current model/version eligibility and issuing CA acceptance |
| Will the token work on this computer? | Supported operating system, driver and required application setup |
On smaller screens, scroll across the table to view all columns.
A successful sign-in or an unexpired certificate answers only part of the decision. It does not establish that a fresh certificate download will be accepted on the same hardware.
CCA's migration advisory allows DSCs downloaded onto FIPS 140-2 modules on or before 21 September 2026 to remain operational until certificate expiry. Those modules are excluded from ordinary renewal or fresh-download use after the cutoff. The advisory describes limited reissue and government exceptions; these are not general renewal routes. CCA migration advisory, English guidance
The decision concerns the module and intended use. A purchase date, working USB connection or seller's “new version” label does not establish eligibility.
Collect the model name and available hardware/firmware version from the device's official information or its trusted management software. Ask the issuer or supplier to check these against the current accepted configuration. CCA's crypto-device requirements address model/version information and CA empanelment, rather than brand name alone. CCA crypto-device requirements, version 2.4
For example, naming only ePass or Proxkey leaves the precise configuration unresolved. If information is unclear, request a model-specific check before paying for a without-token package.
Prepare a short note containing:
Share the relevant product information with the seller or CA through their approved support channel. Keep the token PIN and other authentication secrets private.
If your applicant profile is changing, read the Individual vs Organization DSC comparison. Physical token reuse and selecting a different certificate profile are separate decisions.
Confirm the supported operating-system version and required driver for the exact model. Obtain setup instructions from the manufacturer or the issuer's official resource. A device working on another person's computer does not settle compatibility with yours.
eMudhra's token-buying guidance includes operating-system selection. Use that as a reminder to check the actual device configuration; it does not establish compatibility for every token carrying a particular brand. eMudhra token FAQs
Allow time to test the selected certificate in your intended application after issuance. Ask whether certificate registration or association must be completed before use.
Do not use formatting, initialising or deleting certificates as a quick way to make an older token “renewable”. Seek the issuer's instructions before any destructive change. This is especially relevant where an encryption certificate or related key may be needed for earlier encrypted material.
CCA distinguishes signing and encryption keys and states that signature keys should be generated within the crypto medium and should not be copied. Keep control of your token and authentication details during support. CCA key-storage FAQs
Once eligibility and compatibility have been confirmed, compare the applicable USB token options and DSC renewal options.
Review the full quote: certificate, token where needed, applicable tax and any separately disclosed delivery or service charge. Request the current terms for the selected product.
Renewal also has its own verification process. eMudhra states that renewal requires fresh identity verification. Token compatibility alone does not complete that step. eMudhra renewal guidance
Possibly, but test results for the existing certificate do not confirm eligibility for another download. Check the exact model/version, issuer acceptance and computer setup first.
No. The advisory distinguishes existing eligible certificates continuing until expiry from ordinary renewal or fresh-download use. Check your certificate's current status as well.
Purchase date alone does not identify its validated configuration or the CA's acceptance. Ask for the precise model/version and confirmation for your intended download.
Select it after confirming that your existing device is suitable. Compare the complete applicable quote once the required hardware choice is clear.
Ask the issuer about the intended certificate and device. The presence of an Individual certificate does not convert it into an Organization certificate; applicant-profile selection still needs a separate check.
Deletion does not establish compliance or CA acceptance. Obtain issuer instructions before removing certificates or keys, particularly where encryption is involved.
Confirm the specific written offer and applicable conditions. Do not assume a general free-token exchange from the migration guidance or the availability of a newer model.
Have the exact token details, selected certificate and computer requirements checked together. If you cannot establish the right option, contact DSC Signature for a model-specific token and renewal check before ordering. This gives the renewal discussion a clear starting point and helps you prepare for the next verification and setup steps.
