just in case it’s useful to anyone the command is:
nbcertcmd -getcertificate -server <NBU Master>
If the master server global security is set to high then you’ll first need to generate a token on the master server and use the -token switch in the command line:
nbcertcmd -getcertificate -server <NBU Master> -token <token>
https://www.veritas.com/support/en_US/article.000127129
https://www.veritas.com/support/en_US/article.100044601