Hi all,
I got to bottom of the issue last night -- Raj S & Yong C are spot on.
On my system, security policies had disabled automatic root certificate updates via Group Policy (Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication Settings > Turn off Automatic Root Certificates Update).
If you download the firmware files manually via Internet Explorer (which does not validate the digital signature and prevent download!), you can identify the missing root certificates and then import them into the Computer Store. In my case, I found two root certificates + one issuing certificate missing as Dell have signed some firmware files with a different certificate chained to a different authority!
Note: For the URL provided above by Yong-C, you can only download root certificate updates manually for Windows XP. For other operating systems, you need to let Windows do it internally (if automatic root certificate updates is enabled) or do it manually. See http://support.microsoft.com/kb/931125.
Hope this helps someone else out there!