ISE backup question

[ade5]

In ISE 2.1 . When doing backup configuration both scheduled and manual , does ISE also backs up the certificates? or does this need to be done manually via CLI ?  

 If i reimage primary pan/mnt node and restored from backups will it get back to original state? I have 4 PSNs and secondary Pan/Mnt. How will I get everything back in sync?

I understand I need to rejoin AD but is that what I need to do first? sorry to ask. thank you.

[Nadav]

I would like someone to confirm, but for ISE 2.4 I recall that system and trusted certificates are backed up, but you need to backup the internal CA certificates separately. So if you don't use ISE as an internal CA, you're set.

The internal CA certificates can be backed up via the CLI application menu.