Funny, we were just discussing that yesterday 
Basically you want the “Root Certificate Download” link in the “TrustID X3” section. You’ll also need to use openssl to convert it to the correct format:
openssl pkcs7 -print_certs -in trustidrootx3_chain.p7b -inform der -out identrust.pem
You may or may not have to remove the ‘subject’ and ‘issuer’ lines from the top of the resulting identrust.pem file, I’m not sure if Zimbra will accept them or not.
If you want to try setting up automated renewal, this procedure has been confirmed as working by at least one person. The crt.sh link in there should also be valid (though obviously less authoritative) for downloading the IdenTrust root.