If you used TLS Bootstrapping feature when you deployed the CEG Service, the CA certificate chain will be a certcerts.p7b
file, located in the directory where you exported the Certificate Enrollment Gateway configuration.
For CAs hosted by Entrust PKI as a Service, you should have obtain the CA certificates from the Entrust Certificate Services portal.
Copy this file from the CEG Service host to your machine.