I've seen
but still have a question.

I want to reinstall our first ZCM primary, which was updated form 10.2 all the
way to 10.3.1 and seems a bit unstable at times from the 10.3 media and to a
different path as it it installed to now. We have two more primaries in the
zone (all content replicated) and an external MSSQL DB on a dedicated machine.
All devices are registered to the first primary and we use external
certificates on all ZCM servers.

Documentation above tells me to take a reliable backup of the first primary's
CA, and this is not an optional step for those using an internal CA only.
Unfortunately "zman cae" returns error 120: "You can only use this option when
using the internal CA" and I now am a bit confused whether there even is a CA
role to backup/restore in a zone that uses external certs. Any ideas?

Cheers, Lothar