Signing passwords, backups and lost certificates

Which password is which?

Authority passphrase — chosen when the authority was created. Needed to issue, revoke and renew. Only the certificate officer(s) know it.
Member certificate password — shown once when a certificate is issued. The member types it every time they sign.
Online copy passphrase — chosen by the member when saving their certificate to Firehouse 360. Only they know it; Firehouse 360 cannot open the copy.

Back up the authority (certificate officer)

Keep the whole authority folder in two places: an encrypted cloud folder that is online-only (not synced to every computer) and an encrypted USB stick in the station safe.
Write the passphrase on paper and keep it in the safe, never in the same place as the folder.
Copy the folder again after issuing or revoking certificates, so register.json stays current.

If the authority folder is lost: members can keep signing until their certificates expire, but you can no longer issue new certificates, revoke one, or renew the revocation list. Create a new authority, upload it to Secure Share, and issue everyone new certificates.

Back up a member certificate

Keep a copy of your .pfx file somewhere safe, with its password stored separately.
Or, with Secure Share access, use PDF Fire › Sign › Firehouse 360 › Save My Certificate Online. On another computer, connect PDF Fire and use Get My Certificate. If you forget the online passphrase, the copy can't be recovered — ask your certificate officer for a new certificate.

A member leaves, or a computer is lost

Certificate officer: Department Certificates › Open Authority, select the certificate, Revoke.
Upload the new authority.crl in Secure Share › Settings › PDF Fire signing.
Disconnect the lost computer under Connected PDF Fire computers.

Signatures made before the revocation stay valid; the verify page shows the date the certificate was revoked.