CA certificates are retrieved by calling NPKIGetCACertificates.
You can call NPKIFindOrganizationalCA to get the Distinguished Name (DN) of the CA.
Call NPKIGetCACertificates to retrieve the certificates. Most applications should only use the self-signed certificate.
For a sample implementation of this task, see GetCACert.