Setting up Aadhaar eSign
The five things you need before the feature will switch on, and where each one comes from.
Aadhaar eSign is off until it is configured, and the settings page will not let you switch it on while anything is missing. That is deliberate — the alternative is a signer discovering the gap at the moment they try to sign.
Go to Admin → Signing defaults → 🔐 Aadhaar eSign.
The five things you need
1. An eSign Service Provider. One of the seven organisations empanelled by the Controller of Certifying Authorities. See Choosing an eSign Service Provider.
2. An ASP ID. Your provider issues this when they onboard you. In this arrangement you are the Application Service Provider — you run the document workflow — and they are the eSign Service Provider who does the signing.
3. A signing gateway URL. Also from your provider. Sandbox and production addresses are different. It must be https://; a plain-http address is rejected, because the signer travels to that address.
4. Your organisational Document Signer Certificate, as a PEM certificate and its private key. Every request we send is signed with this, and providers reject unsigned requests. Buy it from a licensed CA — the same conversation as your ASP agreement is the natural place to ask.
The key is never shown back to you once saved. Leave the key box empty when you edit anything else on the page and the stored key is kept.
5. Your provider's response-signing certificate. Replies that don't verify against it are discarded rather than applied. Without it, Aadhaar signing stays unavailable — an unverified reply is a signature we cannot attribute to anybody.
Availability
| Setting | What it does |
|---|---|
| Off | Signers never see the option |
| Offer it to signers | The 🔐 button appears alongside Finish |
| Require it | Aadhaar is the way to sign |
Two advanced settings
Canonicalisation and Signature element only need changing if your provider's integration guide asks. The defaults — inclusive canonicalisation and an unprefixed <Signature> element — are what most providers expect.
Trying it before you have a contract
Choose Built-in test ESP as your provider. It runs the entire flow locally: it verifies our request signature the way a real provider does, shows an OTP screen, and returns a properly signed response. The fixed OTP is 123456.
Everything it produces is real cryptography and has no legal effect — the certificates say TEST, no Aadhaar was used, and the screen says so. Its endpoints stop answering the moment you switch the feature off.