To update the certificate on a Windows machine without direct internet connection:

1. Here is the list of certificates that should be installed before enabling the Anti-Malware Feature:
   • Microsoft Identity Verification Root Certificate Authority 2020
   • DigiCert Trusted Root G4
   • USERTrust RSA Certification Authority
   • DigiCert Assured ID Root CA
   • DigiCert High Assurance EV Root CA
   • VeriSign Class 3 Public Primary Certification Authority G5
   • VeriSign Universal Root Certification Authority
   • Microsoft Root Certificate Authority 2010
   • Microsoft Root Certificate Authority 2011

   If you encountered a similar event as follows, You may download the missing certificates specified in the system event first

   

   In the example above, you need to download and install the missing DigiCert Trusted Root G4 and VeriSign Class 3 Public Primary Certification Authority G5.

2. Install the downloaded certificate on the affected machine with DSA.
   • Install the certificate using the batch file included in the package.
     1. Extract the zip file that you have downloaded
     2. Execute the batch file in the package with administrative privilege.
   • Install the certificates manually:
     1. Open the certificate and click the Install Certificate button.

        

        The Certificate Import Wizard will appear.

     2. Click Next.
     3. Select Place all certificates in the following store and click Browse.
     4. Tick Show physical stores and click Trusted Root Certification Authorities > Local Computer > OK.

        

        If Local Computer is not available under Trusted Root Certification Authorities:

        1. Open the Run window.
        2. Type "MMC" and click OK.
        3. Click the File menu and select Add/Remove Snap-in.
        4. Select Certificates on the left panel and click the Add button.
        5. In the Certificates snap-in window, select Computer account and then click Next.
        6. In the Select Computer window, select the Local computer radio button and click Finish > OK.
        7. Expand Certificates > Trusted Root Certification Authorities in the left panel and then click the Certificates folder.
        8. Click the Action menu > All tasks and then import the certificates.
        9. Click Finish. The message "The import was successful"  will appear.

           

Alternative Solution:
The Trend Micro Deep Security Agent Support Tool can check if the target system has the required certificates or not. The tool can also import the missing certificates.
Go to the "Environment Check" tab to identify and install the missing certificates. 
For detailed information you can refer the his KB article link. 

You may contact the Trend Micro Technical Support to get the latest version of this tool.