(Posting this as an answer by request, and also since the original comment seems to have been well-received and I wouldn't want it to get deleted in a comment purge.)
In response to Lie Ryan noting that there are two basic types of certificates, root certificates and client certificates, and that client certificates are fine but you should be wary of custom root certificates because they have a potential for abuse, I added:
I would state that last line a bit more strongly: a root certificate that is under the control of the same people who own the network used to connect to the Internet should be regarded as spyware. It should be avoided if at all possible, and if it's not possible, the machine should be treated as compromised and used as little as possible. There's no legitimate reason to require you to put one on your own personal property. If the school wants to do that, they can supply the laptops themselves.
Another commenter asked what the link is between spying potential and being the operator of the network. So, some further expounding:
What a root certificate means is that the certificate owner not only certifies that its site is legitimate, but also has the authority to issue other certificates. This is how Certificate Authorities and the entire certificate infrastructure works: by installing the root certificate you say that you trust the judgment of the CA, and the CA then certifies that ordinary sites are legitimate, which you accept because a trusted CA said so.
The thing is, there's no technical requirement anywhere in that process involving input from the owner of the site. That's where the trust part comes in; we accept on faith that they've authenticated the site before issuing a certificate for it, and the few times when a CA has been caught failing to do so, retribution from the Internet has been swift and decisive, bringing consequences up to and including the CA going out of business for betraying the trust of essentially the entire world.
But if your main business isn't being a CA, that changes the calculus. If you run a network and can issue a rogue root CA on your clients' computers, you gain the ability to perform a man-in-the-middle attack. It works like this:
- Client navigates to https://security.stackexchange.com
- Network MITM system pretends to be a client and decrypts the content
- Network MITM re-encrypts the content with its own fraudulent StackExchange certificate, issued by the network's root CA
- Client's browser receives the data, checks the encryption, sees that it's using a certificate signed by a trusted root CA, says "there's nothing wrong with this connection," and displays it to the user
- User is unaware that the network is potentially capable of both reading and modifying his or her HTTPS traffic
This will only work on the certificate owner's network because other networks that don't have a root certificate installed on your machine aren't going to be serving up phony site certificates.