The Delhi High Court has directed the Central Government to decide a representation challenging the September 21, 2026 deadline for private individuals, professionals and commercial entities to migrate from FIPS 140-2 cryptographic tokens to the newer FIPS 140-3 standard for Digital Signature Certificates (DSCs).
The development is significant for advocates, chartered accountants, tax professionals, companies and other businesses that routinely use USB-based digital signature tokens for statutory filings, regulatory compliances, judicial filings and financial transactions.
A Division Bench comprising Chief Justice D.K. Upadhyaya and Justice Tejas Karia directed the Union Government to consider and decide the representation by September 20, 2026. However, the Court did not stay or otherwise interfere with the existing migration framework.
Background of the FIPS 140-2 to FIPS 140-3 Migration
The issue arises from an advisory issued in January 2026 concerning the migration of cryptographic modules used for digital signatures from the FIPS 140-2 standard to FIPS 140-3.
The Office of the Controller of Certifying Authorities (CCA) has advised Certifying Authorities and other stakeholders to move towards FIPS 140-3 validated cryptographic modules. According to the CCA’s advisory, Certifying Authorities are required to stop issuing DSCs in FIPS 140-2 modules from September 21, 2026.
Importantly, DSCs already downloaded into FIPS 140-2 tokens on or before the deadline are permitted to remain operational until the expiry of the relevant DSC. Such tokens, however, cannot subsequently be used for renewal or fresh downloading of DSCs under the normal framework.
The migration is intended to align India’s digital-signature ecosystem with the newer FIPS 140-3 security standard and provide enhanced cryptographic assurance and resilience.
Challenge Before the Delhi High Court
The proceedings arose from a petition filed by advocate Ramkishan Saraswat, who uses a FIPS-validated USB cryptographic token for e-filing and various statutory, judicial, regulatory and financial transactions.
The petitioner challenged the differential treatment allegedly created by the CCA advisory. According to his representation, private and commercial users were required to migrate by September 21, 2026, whereas Government organisations could continue using FIPS 140-2 tokens until September 21, 2029, subject to risk assessment or waiver mechanisms.
The petitioner contended that such different deadlines placed private professionals and entities at a disadvantage despite the stated absence of any known security vulnerability associated with continued use of FIPS 140-2 modules.
He further argued that the different deadlines had been introduced without adequate consultation, regulatory impact assessment or cost-benefit analysis.
Delhi High Court Questions Differential Treatment
During the hearing, the Division Bench raised questions regarding the rationale for prescribing different timelines for Government and private users of digital signatures.
The Court questioned whether there was a legally intelligible basis for treating the two categories differently, particularly when both categories depend on digital signatures for electronic transactions and official processes.
The Bench observed that users of digital signatures should ordinarily be considered on the same footing and questioned why Government users should receive a longer transition period if similar practical difficulties could arise for them as well.
However, the Court did not adjudicate upon the substantive validity of the CCA advisory or conclude that the different deadlines were legally invalid. Instead, it directed the Central Government to consider and decide the petitioner’s representation within the specified timeframe.
Earlier Order of the Single Judge
The latest proceedings followed an earlier order passed by a Single Judge of the Delhi High Court on August 31, 2026.
The Single Judge had directed the Central Government to consider and decide the representation within four weeks. The petitioner subsequently approached the Division Bench alleging that despite the judicial direction, his representation, submitted in June 2026, had not been decided.
The Division Bench declined to interfere with the Single Judge’s order but issued a more immediate direction requiring the Government to decide the representation by September 20, 2026.
What the CCA Advisory Means for DSC Users
The CCA’s migration framework does not mean that every existing FIPS 140-2 token will automatically stop functioning on September 21, 2026.
Instead, the key distinction is between existing DSCs and fresh issuance or renewal.
A DSC downloaded into a FIPS 140-2 token on or before the prescribed date can continue to operate until the expiry of that DSC. However, fresh DSC issuance, renewal or fresh downloading in FIPS 140-2 modules will generally no longer be permitted under the new framework.
The CCA has also advised manufacturers and distributors of cryptographic modules to publish exchange or buy-back policies for replacing older FIPS 140-2 tokens with FIPS 140-3 compliant tokens.
Implications for Professionals and Businesses
The issue has practical importance for professionals and organisations that depend heavily on digital signatures.
Tax professionals, advocates, chartered accountants, company secretaries, businesses and other entities regularly use DSCs for GST filings, income-tax compliance, MCA filings, tender submissions, banking-related processes and other electronic transactions.
Any disruption in DSC availability could potentially affect time-sensitive statutory compliance. Therefore, users relying on older tokens should verify the status of their existing DSC, its validity period and the requirements of their Certifying Authority before the migration deadline.
At the same time, the Delhi High Court’s order does not itself extend the September 21 deadline or suspend the CCA advisory. The Government has been directed only to consider and decide the representation by September 20.
No Final Finding on Validity of the Deadline
An important aspect of the order is that the Delhi High Court has not finally ruled on the validity of the September 21, 2026 deadline.
The Court’s observations regarding differential treatment were made during the hearing, while the substantive issue remains to be considered by the appropriate authorities.
The immediate development is therefore the direction to the Central Government to decide the pending representation within the specified time.
The Government’s decision could provide further clarity regarding the implementation of the FIPS 140-2 to FIPS 140-3 migration framework and the concerns raised by affected users.
Conclusion
The Delhi High Court’s latest order brings renewed attention to the impending transition from FIPS 140-2 to FIPS 140-3 digital signature tokens.
For private professionals and businesses, September 21, 2026 remains an important date under the existing CCA framework. Existing DSCs installed in FIPS 140-2 tokens before the deadline are expected to continue until their respective expiry, while fresh issuance and renewal requirements will be governed by the migration framework.
The immediate question before the Central Government is whether the concerns raised regarding the differential deadlines for private and Government users warrant any reconsideration or clarification.
Until the Government takes a decision, users of digital signature certificates should closely monitor official communications from the CCA and their respective Certifying Authorities and make appropriate arrangements for migration to FIPS 140-3 compliant tokens to avoid disruption in statutory and regulatory filings.
Case: Advocate Ramkishan Saraswat v. Union of India & Anr.
Case No.: LPA 738/2026
Citation: 2026 LiveLaw (Del) 853
Decision Date: September 16, 2026