Hi Marcos,
Anything in the trust store is in the database. Credentials in an external HSM are not in LiveCycle at all, and need to be separately backed up. Trust store is backed up via the normal DB + GDS backup procedure that is outlined in the backup-and-restore documentation.
http://help.adobe.com/en_US/livecycle/9.0/adminHelp/admin.htm?content=000433.html
Something that would potentially concern an RE-only customer is that the DB + GDS is largely "disposable" in practice, and backing up all that junk, just to capture the certs, is a significant effort. In this instance, the recommendation would be to save the cert files prior to importing them to RE. In the case of a requirement to re-build the RE installation, re-install from the installer and re-import the certs gets you back where you were.
Another possibility is to build the initial system, back it up once, and then in case of any problem, restore to that point. The credentials themselves are not changed or updated as you go along, so restoring to an initial "checkpoint" will get things back where they should be.
