In general, the CA certificates are located in `/etc/ssl/certs`

You can download the CA cert and look at it with:

    openssl x509 -in entrust_l1k.cer -text

And then move it into the `/etc/ssl/certs` directory:

    sudo mv entrust_l1k.cer /etc/ssl/certs

And then update the CA certificate database:

    sudo update-ca-certificates

And make sure that the cert has been added to the database.

There are also some cross-signed certs that may need to be added from the same website and in the same way.

In general CA certs should not be manually added to the local database.  There are reasons why certain CAs are not included.  Without further research, it's unclear why this particular CA root cert was not included in Raspbian.  It seems to be included in my Debian 'Buster' installation running Brave Browser... I haven't checked my Raspbian 'Stretch' installation yet.