If you used TLS Bootstrapping feature when you deployed the CEG Service, the CA certificate chain will be a certcerts.p7b file, located in the directory where you exported the Certificate Enrollment Gateway configuration.

For CAs hosted by Entrust PKI as a Service, you should have obtain the CA certificates from the Entrust Certificate Services portal.

Copy this file from the CEG Service host to your machine.