What are the implications of the “do not validate” message for wifi network certificate?

Question

I know a year ago when signing into school wifi there were a few options. First time I had to sign into a school wifi, so I did not understand the difference. Ended up choosing a wireless option. One of the sections for that option asked to select a certificate. The options were: use system certificates/do not validate. I went with the second option since I did not know about certificates or what it referred to with system certificates. After that I choose that and put my ID and password, I clicked connect and that took me to the authentication login I normally have to sign into which sends my phone a notification to approve it is me. Then I was in. It gave that red message that connection was not private. This was on an android phone.

Recently I learned about certificates, security of websites, and dangers such as MITM attack. Basically I wanted to get an understanding of what kind of things were visible while using that wifi last year. Such as:

Websites that are HTTPS would normally not let a wifi admin see what I do on the website but only that I went to the website. If the connection is not private while using that school wifi as mentioned, are the contents of that website now visible?

Are the contents messages I send or receive such as in discord, insta, Facebook, and so on which are normally encrypted (in transit) now completely visible Or does one still have to “purposefully” MITM attack to see it?

Same for emails which are normally encrypted in transit (only thing normally visible is that is used the app, not what in the app).

Honestly, I have nothing to hide. It just really bugs me that the “specifics” of this stuff was actively monitored. Since not only my messages could have been seen but also bank account and such. I don’t mind if it shows what site I went or what app I used, what bugs me is if the “contents” are visible while the wifi connection was not private.

Answer 1

With WPA2- and WPA3-Enterprise, there are several different types of authentication that can occur. Of these, there are some, including EAP-TLS and EAP-TTLS, that can involve the use of TLS or the presentation of a certificate by the server. When you're prompted in this case, the question is of verifying this certificate as being valid according to the system certificates, and for this purpose usually you have to provide a domain name to verify.

If you don't verify the certificate, then an unauthorized party could pretend to be the Wi-Fi network you're connecting to and steal your credentials. However, this doesn't affect other sites you connect to with TLS, such as HTTPS sites in your browser, since certificate verification for these sites is not controlled by the same option as for Wi-Fi. In general, any other site using TLS is secure, although if you're using an insecure network, an attacker could see the domain name of the site you're connecting to (which is typically exposed as part of the TLS connection). They could also see any insecure site you contact (such as a plain HTTP site) and also tamper with DNS (since DNS is typically not encrypted by default unless you use DNS over some TLS-based protocol).

Emails are usually sent over TLS these days, and therefore are usually protected from tampering, although in many cases the TLS requires negotiating a plaintext connection, so in some cases an attacker could have forced a plaintext connection.

Note that even if you verified certificates for the Wi-Fi, that doesn't prevent an attacker on the network (such as your school's system administrator) from snooping on the data. However, as mentioned, anything using TLS is generally immune from snooping or tampering except for the domain name.

Conducting a MITM attack on the Wi-Fi network without being detected would practically be very difficult, since a general attack would alert anyone who had selected certificate verification and thus practically the attack would likely have had to have been targeted. Thus, it isn't very likely that anyone actually compromised your school's Wi-Fi network, although we can't be certain.