Step 5 in section "Using certutil" of the The Directory Server Administrator's Guide 7.1, Chapter 11, generates "the encryption key" using the -G option. According to the certutil documentation, this generates a public/private key pair. 
What is this key pair used for? It doesn't seem to be the key used for the self-signed ceritficate or the server certificate, as the -S switch on certutil -  judging by the available options for -S  - appears to generate a new key pair.
 
Thanks,
Gabi