About certificate enrollment
In case of NetBackup CA, certificates are automatically enrolled with the primary server during certificate deployment.
In case of external CA, certificates are automatically enrolled with the primary server during host communication if the ECA_DISABLE_AUTO_ENROLLMENT option is enabled. You can enroll the certificate manually using the nbcertcmd -enrollCertificate command.
The enrolled certificates are used for host communication.