First Question:

My understanding is that if you are using an Internal CA and have two Primary servers in a Zone and one of them crashes, then when you install the crashed server back into the Zone, it will automatically grab the certificates from the other server.

Is that correct?

Second Question

If you have a single ZCM server in its own Zone and it crashes you could restore the server completely from backup and thats a given. Is there a way to export the certficate that it was originally built with before the crash and then reimport it so that new certfifcates do not need to be pushed out to the managed devices?