Enrollment is the process of requesting a certificate from Adobe. You can generate keys and create a request that is sent to Adobe. Adobe then generates the certificate and sends it to you. Adobe does not know the contents of the private key. Therefore, you must back up the key to recover it if any of your hardware fails.
Unlike the License Server, Packager or Transport certificate, Adobe does not issue the Domain CA certificate. You can obtain this certificate from a Certificate Authority or you can generate a self-signed certificate.
See the * Primetime DRM Certificate Enrollment Guide* on how to obtain Primetime DRM credentials.