When installing Authentication Services in a Windows environment the following certificates are required.
If the server has internet access then these certs are automatically downloaded during installation.
If the server is offline then they must be manually imported and installed.
Note: When importing a certificate allow Windows to automatically select the certificate store.
Note: Authentication Services versions 220.127.116.1191 and above required the above noted "DigiCert Assured ID Root CA" certificate in the "Trusted Root Certification Authorities" certificate store. Prior to that build the above noted VeriSign certs are needed.