Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is there anything to protect you from something being wrong with the certificate of the website with which you connect? For example due to a man in the middle attack.
So visually this is how it's "supposed" to be
cert1 cert 2 server -> company network -> user
but what prevents this:
cert 1 made up cert cert 2 server -> man in the middle -> company network -> user
after all it seems like the company network isn't able to properly judge if a false certificate should be trusted or not (might be that the user is the companies owner and has self signed or that this is a bank that should be certified by a trusted authority and now isn't)?