You need a list of Root Certificates required for installing Symantec Endpoint Protection (SEP) 12.1 RU4 MP1.
In a closed network when there is no Internet access or a Windows Server Update Services (WSUS) server, you need to install/import only the certificates that are required for a SEP RU4 MP1 installation.
Per TECH218029, updating all certificates from root.zip or by applying KB931125 there can be more certificates than required. Also, installing KB931125 on Windows 2003 servers can break all TLS communication.
It has been confirmed that only the 6 certificates (with their thumbprints) listed below are required to install SEP 12.1 RU4 MP1, under Trusted Root.