Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication.

Can these certificates be used by the provider to execute man-in-the middle attacks between the user and HTTPS websites that the user is browsing?

Or, are certificates/CAs installed for EAP authentication different from the OS/browser's SSL certificate chain?

If the Passpoint AP provides a self-signed certificate or even a new root CA, does trusting these certificates open the client to MITM attacks while using HTTPS sites on that network?

Also, the screenshots provided by this LinkNYC user here : http://blog.alexflor.es/post/137705262900/linknyc-secure-gigabit-hotspot seem to suggest an entire chain upto a root is provided to be installed on the client. Is the entire chain presented simply because of the EAP-T(TLS) spec (as mentioned in the accepted answer here: Why is a CA certificate required for EAP-TLS clients?)?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication.

Can these certificates be used by the provider to execute man-in-the middle attacks between the user and HTTPS websites that the user is browsing?

Or, are certificates/CAs installed for EAP authentication different from the OS/browser's SSL certificate chain?

If the Passpoint AP provides a self-signed certificate or even a new root CA, does trusting these certificates open the client to MITM attacks while using HTTPS sites on that network?

Also, the screenshots provided by this LinkNYC user here : http://blog.alexflor.es/post/137705262900/linknyc-secure-gigabit-hotspot seem to suggest an entire chain upto a root is provided to be installed on the client. Is the entire chain presented simply because of the EAP-T(TLS) spec (as mentioned in the accepted answer here: Why is a CA certificate required for EAP-TLS clients?)?