Firehouse 360

Set up department signing with PDF Fire

PDF Fire signs PDFs with certificates. A department makes one master certificate — the authority — and the authority issues a personal signing certificate to each member. The authority itself never signs documents. Secure Share publishes the authority's public files so every computer and PDF reader can trust your members' signatures.

1. Copy your revocation list address

In Firehouse 360 open Secure Share › Settings › PDF Fire signing. The green box shows your revocation list address, for example https://firehouse360.com/pki/your-department/authority.crl. You need it in the next step. If PDF Fire is already connected to Firehouse 360, PDF Fire fills it in for you.

2. Create the authority (certificate officer, once)

  1. In PDF Fire open Sign › Department Certificates › Create Authority…
  2. Name it, for example Name VFD Signing Authority, and enter your department as the organization.
  3. Paste the address from step 1 as the revocation list address. It is written into every certificate and can't be changed later.
  4. Choose a folder and a passphrase of at least 12 characters (a few unrelated words). Write the passphrase on paper.
  5. Answer Yes to Trust it on this computer now?

The folder (by default in Documents, named after the authority) now holds four files:

  • authority.cer — the authority's certificate. Public; share it freely.
  • authority.crl — the revocation list (which certificates were cancelled). Public. PDF Fire makes it automatically.
  • authority-private.p12 — the authority's key. Secret. Anyone with this file and its passphrase can issue certificates in your department's name.
  • register.json — the list of certificates issued.

3. Upload the two public files

  1. In Secure Share › Settings › PDF Fire signing, upload authority.cer, then authority.crl.
  2. Compare the fingerprint on the card with the one in PDF Fire: open Sign › Department Certificates — the line under the authority's name says Fingerprint: XXXX XXXX …. They must be identical.

Never upload authority-private.p12 or a member's .pfx. Secure Share refuses them anyway.

4. Give each member a certificate

  1. Identify the member in person — that is what makes their signatures hold up later.
  2. In Sign › Department Certificates click Open Authority…, choose any file in the authority's folder, and type the authority's passphrase.
  3. Click Issue Certificate…, enter the member's name, rank or title and e-mail, and save the .pfx file.
  4. PDF Fire shows a password once. Give the member the .pfx file and the password separately if you can.

5. The member signs

  1. Sign › My Certificates › Import, choose the .pfx, type its password, and answer Yes to trusting the department's authority.
  2. Open the PDF and click Sign with Certificate. The member's own certificate is in the list — type its password, tick the consent box, place the signature, and save.

Common questions

I clicked Sign with Certificate and don't see a department certificate

The authority does not sign. Issue a personal certificate from it (step 4), import it (step 5), and then it appears in the list.

I made a second authority by mistake

If you used Create Authority when you meant Issue Certificate, you made another master certificate. In Department Certificates, select it under Departments trusted on this computer, click Stop Trusting, and delete its folder. Keep only your department's real authority.

How do I make the revocation list again?

PDF Fire writes a new authority.crl whenever you revoke a certificate, and when you click Renew Revocation List (do this once a year — the card shows Renew soon 30 days ahead). Upload the new file to Secure Share each time.