Digital signature certificates for e-GP: a step-by-step guide

A digital signature certificate (DSC) is an electronic credential that binds your identity to a cryptographic key pair. When you sign a document with it, anyone can verify that the signature came from you and that the document has not changed since. In Bangladesh, signatures made with a certificate from a licensed Certifying Authority carry legal weight under the ICT Act 2006 and the Information Technology (Certifying Authorities) Rules 2010.

That legal recognition is the reason government systems require one. A scanned signature can be copied; a digital signature cannot be forged without your private key.

The e-GP portal replaces paper tenders with electronic ones. Every bid, bid security document and contract needs a signature that a procuring entity can trust and that can be produced as evidence later. A DSC from a licensed CA gives the portal that trust: it can check who signed, when, and whether the file is intact.

Bidders are not the only users. Officers in procuring entities sign tender documents, evaluation reports and awards the same way, which is why many ministries and agencies issue certificates to staff in bulk.

1. 01Confirm what you need. Check the e-GP guidance for your role (bidder, procuring entity officer, bank user) so you apply for the right kind of certificate. Certificate classes and validity periods vary; confirm the current requirement with the CA before applying.
2. 02Choose the certificate. Individual certificates identify a person; organizational certificates identify a person acting for a company. Most bidders sign as an authorised representative of their organization.
3. 03Gather documents. Expect to provide proof of identity, proof of the organization (registration and authorisation letters) and a passport-size photograph. Your CA will list exactly what applies.
4. 04Apply and verify identity. Submit the application to the CA. Identity checks are part of what makes the signature legally valid, so allow time for verification rather than treating it as paperwork.
5. 05Install and protect the key. Certificates are delivered on a secure USB token or installed with the CA's software. The private key must stay with you. Sharing a token is the equivalent of handing over your signature.
6. 06Register on e-GP and sign. Link the certificate to your e-GP account, then test it on a sample document before a live deadline.

• Applying the week of a tender. Verification takes time. Apply when you register on e-GP, not when a notice appears.
• Letting the certificate expire. Certificates have a fixed validity. Renew before expiry, or you will be locked out of signing at the worst moment.
• Wrong signatory. The certificate holder must be the person authorised to bind the organization. Update it when staff change.
• Ignoring revocation. If a token is lost or an employee leaves, ask the CA to revoke the certificate immediately so nothing can be signed in your name.

Mango CA was licensed by the Office of the CCA in 2011 and was the first to introduce digital certificates and SSL for government, businesses and individuals in Bangladesh. Certificates are issued through Mango CA, and our team supports organizations that need to roll certificates out to many signers at once.