After Configuring an Entrust PKIaaS issuing CA for MDM, download the certificates of the root and issuing CAs. You will need these certificates when:

See Downloading a CA certificate to download CA certificates from the Entrust Certificate Services Enterprise portal.