I have one RB in production, using certificates to serve OpenVPN connections. I have another identical unit on the shelf (so to speak), just in case. Export takes care of the configurations - but not certificates.

Is there some automatic way to backup/restore certificates? I can copy them to the new unit, since I create them outside RB. But would be far easier, and less error prone, if I could do a backup/restore...

This is one of the reasons that has held me back from using certificates...
I think they are included in a "backup" (the binary file), but as you write, not in an export.
And when you get a new router, you cannot even reset it to the state defined in the export, because this
refers to certificates that are not yet in the router.

i have the same issue, and i would love to see an official answer, (how to export or backup all certificates in case of main router is damaged) thanks!

You can wait ages here. Ask support via email directly and let us know.