You plug in your DSC USB token and... silence. No Windows sound. No LED blinking. Or maybe the LED is on but nothing shows up in emSigner. Or emSigner shows a certificate, but the GST portal refuses to detect anything. "Token not detected" errors manifest differently at different layers — and each layer requires a different fix.
This guide provides a systematic diagnostic and fix approach for every type of "digital signature token not detected" scenario in India, covering all major token brands and all versions of Windows.
📋 Table of Contents
- The 4 Detection Layers: Where Is It Failing?
- Quick Diagnosis: What Are You Seeing?
- Fix: Windows Not Detecting Token at All
- Fix: Device Manager Yellow Triangle
- Fix: Token Software Not Seeing Certificate
- Fix: emSigner Not Detecting Token/Certificate
- Fix: GST/Government Portal Not Detecting DSC
- Fix: Token Disconnects and Reconnects Repeatedly
- Windows Services Required for Token Detection
- USB Power Management: Silent Token Killer
- Diagnosing Token Hardware Failure
- Token Detection in Corporate/Managed Environments
- ePass2003-Specific Token Detection Fixes
- SafeNet eToken-Specific Fixes
- Frequently Asked Questions
1. The 4 Detection Layers: Where Is It Failing?
Token detection is a chain of four layers. Failure at any one layer appears as "not detected" but requires a different fix:
Layer 1: USB Hardware Detection
Windows recognizes a USB device is connected. Test: Does the Windows device-connected sound play? Does anything appear in Device Manager? If no → USB port problem or dead token hardware.
Layer 2: Driver / Device Recognition
Windows loads the correct driver and classifies the token as a Smart Card Reader. Test: Open Device Manager — does your token appear under "Smart card readers" without a yellow triangle? If yellow triangle or missing → driver problem.
Layer 3: Token Software / PKCS#11 Layer
Token management software (ePass Manager, SafeNet Authentication Client) can enumerate certificates on the token. Test: Open your token management software — can you see the certificate? If not → PKCS#11 library issue, wrong driver version, or token content issue.
Layer 4: Application Layer (emSigner / Browser)
emSigner can access the token via PKCS#11 and present certificates to the browser. Test: Launch emSigner as Administrator — does your certificate appear in the dropdown on the GST portal? If not → emSigner configuration or browser WebSocket issue.
2. Quick Diagnosis: What Are You Seeing?
No USB sound + no Device Manager entry
Layer 1 failure. USB port problem or token hardware dead. → See Section 3.
USB sound + yellow triangle in Device Manager
Layer 2 failure. Driver not installed or wrong driver. → See Section 4.
Device Manager OK + token software shows nothing
Layer 3 failure. PKCS#11 library issue. → See Section 5.
Token software OK + emSigner shows no certificate
Layer 4 failure (emSigner). emSigner configuration. → See Section 6.
emSigner shows certificate + GST portal says "not detected"
Layer 4 failure (browser). Browser WebSocket issue. → See Section 7.
Token connects and disconnects repeatedly
USB instability. Power management or port issue. → See Section 8.
3. Fix: Windows Not Detecting Token at All
If inserting the token produces no USB sound and nothing appears in Device Manager, Windows is not detecting any USB device. This is the most fundamental failure.
Try All USB Ports
Systematically try every USB port on your computer — including those on the back of a desktop PC. If the laptop or PC has both USB 2.0 (black) and USB 3.0 (blue) ports, try both types. Some older tokens don't initialize properly on USB 3.0 — try a USB 2.0 port specifically.
Avoid USB Hubs
USB hubs (especially passive, non-powered hubs) provide less power than direct motherboard ports. DSC tokens draw some power for their security chip, and insufficient power causes them to appear dead. Connect directly to the computer's built-in USB port, not through a hub or docking station.
Check Token LED
When you insert the token, does its LED light up? A lit LED (usually amber, red, or green) means the token is powered and hardware is intact. No LED after trying multiple ports = dead token hardware. If LED is on but Windows still doesn't react = USB communication issue.
Test on Another Computer
Take the token to another computer (ideally with the same driver installed). If Windows recognizes the token there but not on your primary computer, the issue is your primary computer's USB controller or port. If it's not recognized anywhere, the token hardware has failed.
Check USB Controller Drivers
Open Device Manager → expand "Universal Serial Bus controllers." If any entry shows a yellow triangle, the USB controller driver needs updating. Right-click → Update driver. Also check if the USB Root Hub entries are functioning correctly.
Restart USB Services
Open Command Prompt as Administrator and run:sc stop usbstorsc start usbstor
This restarts the USB storage driver service which also affects USB device enumeration.
4. Fix: Device Manager Yellow Triangle
A yellow triangle means Windows sees the hardware but cannot properly load a driver. The specific error code tells you exactly what's wrong:
| Code | Message | Fix |
|---|---|---|
| Code 28 | No driver installed | Download and install the correct driver for your token model |
| Code 10 | Cannot start device | Uninstall the device, remove token, reinstall driver, reinsert token |
| Code 43 | Device reported a problem | Reinstall driver; token hardware may be partially damaged |
| Code 52 | Cannot verify digital signature | Download Windows 11-compatible driver; or temporarily disable driver signature enforcement |
| Code 37 | Cannot initialize driver | Conflict with another smart card driver; clean uninstall all smart card middleware and reinstall only the needed one |
Fix Smart Card Service
The Windows Smart Card service must be running for token drivers to function. Check it:
sc query SCardSvr
If status shows "STOPPED," start it:
sc start SCardSvr sc config SCardSvr start= auto
The second command sets the service to start automatically with Windows. Restart the computer after running these commands.
5. Fix: Token Software Not Seeing Certificate
If Device Manager shows the token correctly (no yellow triangle, listed under Smart Card Readers) but the token management software shows no certificate — the PKCS#11 layer is failing.
Restart the Token Software
Close the token management software completely (check Task Manager to ensure it's not running in background). Remove and reinsert the token. Open the token software again.
Run Token Software as Administrator
Right-click the token management software shortcut and select "Run as Administrator." Some token software versions require elevated privileges to access the PKCS#11 library on certain Windows configurations.
Check Token Initialization Status
Some tokens can be "uninitialized" — they have the hardware but no certificate has been written. This is a CA provisioning issue. Contact your CA (eMudhra, Sify, NSDL, etc.) and provide your token serial number. They can verify whether the certificate was properly written to the token.
Re-import Certificate
If the certificate was exported from the token (e.g., as a .p12 file) but not properly re-imported after a token format/reset, it won't appear. Use the token management software's "Import Certificate" function, or request the CA to re-provision the certificate onto the token.
Check for Multiple Smart Card Middlewares
If you have multiple smart card middleware packages installed (e.g., both ePass2003 and SafeNet), they may conflict at the PKCS#11 level. Uninstall all except the one for your specific token type. Restart and test.
6. Fix: emSigner Not Detecting Token/Certificate
Token management software shows the certificate, but emSigner's certificate dropdown on the portal is empty.
Restart emSigner as Administrator
Exit emSigner completely (right-click tray icon → Exit). Then right-click the emSigner shortcut → "Run as Administrator." Wait for the service to start (15–20 seconds), then retry the GST portal.
Reinsert Token While emSigner is Running
With emSigner already running (as Administrator), remove the USB token and reinsert it. This forces emSigner to re-enumerate USB devices. Wait 5 seconds after reinsertion, then refresh the portal page.
Check emSigner's PKCS#11 Library Configuration
emSigner needs to know the location of your token's PKCS#11 library DLL. In some installations, this must be configured manually. Open emSigner settings (if available from the tray menu) and verify the "Library path" or "PKCS11 path" points to the correct DLL. For ePass2003, this is typically C:\Program Files\ePass2003\pkcs11\eps2003pkiP11.dll.
Update emSigner
An outdated emSigner version may not recognize newer token driver versions. Download the latest emSigner from gst.gov.in → Downloads. Compare version numbers — if the downloaded version is newer, uninstall old and install new.
Reinstall Token Driver After emSigner Update
Sometimes, updating emSigner disrupts the registered PKCS#11 library paths. After an emSigner update, do a clean reinstall of the token driver as well to re-register all library paths correctly.
7. Fix: GST/Government Portal Not Detecting DSC
emSigner is running, certificate appears in emSigner — but the government portal shows "DSC not detected" or no signing option appears.
Test emSigner Directly in Browser
Open a new browser tab and navigate to https://localhost:1585. Accept any certificate warning. If you get a response page (even blank), emSigner is running. If "Connection refused," emSigner has stopped — restart it.
Switch Browser
Close all Chrome windows. Open Firefox. Navigate to the GST portal and try signing again. Chrome's WebSocket security policies frequently block the portal-to-emSigner connection even when emSigner is working perfectly.
Add localhost:1585 Exception in Firefox
In Firefox, navigate to the GST portal. When the DSC signing panel appears, look for a shield icon in the address bar. Click it → select "Disable protection on this page." This allows mixed-content WebSocket connection. Alternatively, go to about:config → set network.websocket.allowInsecureFromHTTPS to true.
Clear Browser Cache Completely
In Firefox: Press Ctrl+Shift+Delete → Select "Everything" for time range → Check all boxes → Clear Now. Close Firefox, reopen, navigate to GST portal fresh. Stale cached JavaScript can sometimes cause the portal to incorrectly report "DSC not detected" even when everything is fine.
Check GST Portal Server Status
Occasionally, the DSC-related services on the GST portal server itself are down for maintenance. Check gst.gov.in/newsandupdates for maintenance notifications. Also try again after 30 minutes — transient server-side issues often resolve on their own.
8. Fix: Token Disconnects and Reconnects Repeatedly
If Windows plays the device-connected and device-disconnected sounds repeatedly after inserting the token (USB cycling), or if the token keeps dropping from Device Manager, these are the causes and fixes:
Disable USB Selective Suspend
This is the most common cause of USB cycling. Windows aggressively suspends USB devices to save power, then revives them — and some tokens don't handle this gracefully. Fix:
Control Panel → Power Options → Change plan settings → Change advanced power settings → USB settings → USB selective suspend setting → Disabled. Apply to both "On battery" and "Plugged in" settings.
Set USB Root Hub to Not Power Off
Device Manager → Universal Serial Bus controllers → Right-click each "USB Root Hub" → Properties → Power Management tab → Uncheck "Allow the computer to turn off this device to save power." Do this for all USB Root Hub entries.
Try Different USB Port
A physically damaged USB port can cause cycling — the connection is intermittently broken. Try all other available USB ports. On laptops, ports on the back or underside may be more stable than those on the sides.
Check Token for Physical Damage
Inspect the metal USB connector on the token — look for bent contacts, debris, or corrosion. Clean gently with a soft dry cloth. If the connector appears physically damaged or loose, the token needs replacement.
9. Windows Services Required for Token Detection
Several Windows services must be running for DSC tokens to work. Check all of these:
| Service Name | Display Name | Required State | How to Check |
|---|---|---|---|
| SCardSvr | Smart Card | Running (Auto) | services.msc → Smart Card → Start if Stopped |
| SCardDrv | Smart Card Device Enumeration Service | Running (Manual/Trigger) | Should start automatically when token is inserted |
| CertPropSvc | Certificate Propagation | Running (Manual) | Required for certificate import from token to Windows store |
| CryptSvc | Cryptographic Services | Running (Auto) | Required for all PKI operations |
| SENS | System Event Notification Service | Running (Auto) | Needed for USB device event notifications |
To restart all these services at once, run this in Command Prompt as Administrator:
net start SCardSvr net start CryptSvc net start CertPropSvc
10. USB Power Management: Silent Token Killer
Windows' USB power management is the most frequently overlooked cause of token detection issues — especially in laptops. The OS silently suspends USB devices to extend battery life, and some DSC tokens don't properly wake up from suspend state.
The symptoms of power management issues: token works fine when you first plug it in, but after 5–10 minutes of inactivity it stops being detected. Or it works fine when plugged into power but fails on battery.
Complete Power Management Fix
- Disable USB Selective Suspend (Power Plan): Control Panel → Power Options → Change plan settings → Change advanced power settings → USB settings → USB selective suspend setting → Disabled
- Disable USB Root Hub power management: Device Manager → USB controllers → Each USB Root Hub → Properties → Power Management → Uncheck "Allow computer to turn off..."
- Use High Performance power plan during filing: Control Panel → Power Options → select "High Performance" (may need to click "Show additional plans"). This plan disables most power saving features.
- Disable sleep/hibernation during DSC tasks: Settings → System → Power & Sleep → set both "Screen" and "Sleep" to "Never" while filing.
11. Diagnosing Token Hardware Failure
Token hardware can fail. Signs that point to hardware failure rather than software issues:
- Token LED doesn't light up on any USB port on any computer
- Token LED lights up but device never appears in Device Manager on any computer
- Token was working, then dropped and now doesn't work (physical damage)
- Token was exposed to moisture, extreme heat, or electrical damage
- Token is older than 5 years (USB contacts can wear out)
A hardware-failed token cannot be repaired. The private key is stored inside the token's secure element and cannot be recovered — it is permanently lost. You will need to:
1. Get a new token from a hardware supplier or through your CA
2. Request your CA to issue a new DSC and provision it on the new token
3. Re-register the new DSC on all government portals (GST, MCA, Income Tax, etc.)
The cost of a new token + DSC issuance ranges from ₹1,500–₹4,000 depending on the CA and token type. Some CAs offer emergency/urgent processing within 24 hours for an additional fee.
12. Token Detection in Corporate/Managed Environments
Corporate environments present unique DSC challenges due to IT policies, group policies, and endpoint security software:
Common Corporate Environment Issues
| Issue | Cause | Solution |
|---|---|---|
| Token not recognized at all in office | USB storage class blocked by group policy (DeviceBlock policy) | Request IT to whitelist the token's VID/PID in USB policy; Smart Card devices should not be in USB block lists |
| Driver won't install in corporate laptop | Software installation restricted by admin policy | Request IT to install the driver; provide the official driver installer. IT can use Group Policy to push the driver deployment |
| Token detected but emSigner blocked | Application whitelist blocking emSigner.exe | Request IT to add emSigner.exe to the application whitelist (CarbonBlack, AppLocker, Symantec Endpoint, etc.) |
| Port 1585 blocked | Corporate firewall or DLP software monitoring localhost traffic | Request IT to allow localhost:1585 as a local exception |
| Token works on mobile hotspot but not corporate WiFi | Corporate network-level port blocking | Use personal hotspot for DSC-dependent filing, or request IT to whitelist GST portal's DSC endpoints |
13. ePass2003-Specific Token Detection Fixes
The ePass2003 is the most common DSC token in India. Here are its unique troubleshooting steps:
- ePass2003 not detected on USB 3.0: This is a documented issue. The ePass2003 hardware has timing issues with some USB 3.0 controllers. Always use USB 2.0 ports. If your laptop only has USB 3.0, a USB 2.0 hub can paradoxically help by adding timing buffers.
- ePass2003 detected in Device Manager as "Smart card reader" but ePass Manager shows "No Reader": The ePass2003 Auto driver and the Windows PC/SC subsystem are conflicting. Try restarting the Smart Card service (SCardSvr). If that fails, uninstall ePass2003 driver, restart, install fresh v3.0 or v4.0 driver.
- ePass2003 LED is green but certificate empty in ePass Manager: The token was either improperly provisioned (contact your CA) or the certificate was deleted. A token reset is needed — contact your CA with the token serial number.
- ePass2003 v2.x driver not working on Windows 10 v21H2+: Microsoft's October 2021 and later Windows 10 updates changed how the PC/SC stack works, breaking older ePass2003 Auto v2.x drivers. Upgrade to v3.0 or v4.0.
14. SafeNet eToken-Specific Fixes
- "Token not present" in SAC despite LED being on: In SAC, go to Tools → Diagnostics. This runs a self-check. If diagnostics fail at "PC/SC Reader check," the PC/SC Smart Card service (SCardSvr) is the issue — restart it.
- SAC shows token but "no certificates": This is almost always a CA provisioning issue. The token was issued but the certificate was never programmed. Contact your CA with the eToken's serial number (visible in SAC under Token Properties).
- SAC and emSigner conflict: SafeNet Authentication Client sometimes installs a conflicting smart card minidriver that blocks emSigner's PKCS#11 access. Go to SAC → Advanced → Configure minidriver and disable the SAC CSP minidriver if not needed. Test emSigner after this change.
- SAC 10.x not installing on Windows 11: Download the latest build directly from Thales (cpl.thalesgroup.com) — older builds of SAC 10.x from 2021 don't support Windows 11. Builds from 2023 onward support Windows 11.
Frequently Asked Questions — Token Not Detected
Why is my digital signature token not detected in Windows?
Token not detected in Windows is caused by: driver not installed, faulty USB port, USB selective suspend putting the token to sleep, Windows Smart Card service stopped, or conflicting security software. Use the 4-layer diagnostic: check USB hardware detection → Device Manager → token software → emSigner, and fix the first layer that fails.
Token is recognized by Windows but not by emSigner — what to do?
If Device Manager shows the token without warnings but emSigner doesn't list certificates: restart emSigner as Administrator, reinsert token while emSigner is running, check emSigner's PKCS#11 library path configuration, update emSigner to the latest version, or reinstall the token driver.
How do I check if my DSC token is physically working?
When plugged in, the token's LED should light up. Windows should play the device-connected sound. Device Manager should show the token under Smart Card Readers. Token management software should show the certificate. If none of these happen on any computer, the token hardware has failed.
USB token LED is on but still not detected by GST portal — why?
LED on means hardware is working. The issue is at Layer 4 — emSigner or browser. Check if emSigner is running (tray icon), test localhost:1585 in browser, switch from Chrome to Firefox, and clear browser cache.
My token was working yesterday but stopped being detected today. What changed?
Sudden failures after working are usually caused by: Windows Update changing driver policies, antivirus update blocking the token driver or emSigner, or USB power management putting the token to sleep permanently. Check Windows Update history and antivirus logs for recent changes.
How do I fix 'Token not found' in ePass2003 Manager?
Try USB 2.0 port (not USB 3.0). Close and reopen ePass Manager. Check Windows Smart Card service (SCardSvr) is running. Reinstall ePass2003 Auto driver v3.0 or v4.0. If using Windows 10 v21H2+, v2.x drivers don't work — must upgrade to v3.0+.
Can a damaged USB port cause token not detected error?
Yes. A damaged USB port causes intermittent or complete token detection failure. Try all available USB ports on your computer. If the token works on another computer, the port is the issue. If it fails everywhere, the token hardware may be damaged.
Why does my token disconnect and reconnect repeatedly?
USB cycling is caused by USB selective suspend (most common — disable in Power Options), insufficient USB power (avoid USB hubs), a physically damaged port, or driver conflicts. Disable USB selective suspend and set USB Root Hubs to not power off in Device Manager.
My PC doesn't make the USB sound when I insert the DSC token. What's wrong?
No USB sound means Windows isn't detecting any USB device. The token hardware may be completely dead (test on another computer), the USB port may not be working, or the USB controller driver needs updating. Check Device Manager for USB controller issues.
How to fix 'Token not present' error in SafeNet Authentication Client?
Remove and reinsert token. Run SAC Diagnostics (Tools → Diagnostics). Check Windows Smart Card service is running. Try restarting SCardSvr service. Reinstall latest SAC from Thales website. Check for conflict with Microsoft smart card minidriver in SAC's advanced settings.
Token Not Detected Before a Deadline?
ClearlyComply's experts help resolve DSC token detection issues quickly — so your GST, MCA, or Income Tax filing is never delayed by a technical problem.
Get Urgent DSC Help →