To resolve this, follow these steps:

1. Execute the SQL query, update_workloadsecuritylinks_with_sentigo_public_ca.sql on the DSM's database to replace the Entrust public CA with Sectigo public CA (USERTrust RSA Certification Authority).
2. Verify that the change takes effect by executing this SQL query:

   select * from workloadsecuritylinks;

3. Restart the Trend Micro Deep Security Manager service.
4. Migrate the agent again.