I wouldn't have thought that certificates could be used to track my history, I thought they were essentially login credentials, but I installed some to use my Uni wifi and now my google pixel 3 has a warning that says "Network may be monitored", even when I'm at home and not using the uni wifi. Can they see what I'm doing when not on their network? Thanks
1 Answer
No, the uni cannot monitor unrelated networks.
When you configure your device to trust a new root certificate, that certificate holder can issue HTTPS certificates for any website, and the HTTPS certificates will be trusted by your device. This would allow them to impersonate websites if the root certificate holder is in between you and the website you want to access (MITM attack). This is the case within your uni network, as the university can intercept any connections. This is also the case when you use your uni VPN. This is not the case on other networks, as the uni has no way to intercept your traffic. Your phone wouldn't know on which networks that root certificate could be used to intercept your traffic.
It's worth noting that not all certificates are such root certificates. It is also possible to use certificates solely for authentication when connecting to a network, without making MITM attacks possible. This depends on how you added the certificate to your device.
