This article describes how to enroll the PKI certificate if the devices are in cluster.

When the devices are in cluster and should we enroll the certificate on both the nodes or on primary node alone

Since the devices are in cluster, we can follow the same process to enroll the certificate. However enroll the certificate to the primary node alone. It will sync with the secondary node and no need to enroll it to the secondary node separately.