⚠️ TLDR: You probably would not want to do that! This will install what is essentially a **backdoor into your encrypted communications**. ([TLS interception](https://wiki.openrightsgroup.org/wiki/TLS_interception)) ☣️ --- There are several possibilities: 1) This is a CA certificate used for TLS interception (MITM). 2) This is a (non-CA) certificate of a authentication server and it is used only for communicating with this authentication server during the Wifi handshake (when using WPA-EAP/WPA-Entreprise using either of EAP-TLS, EAP-TTLS, PEAP, EAP-FAST, TEAP, etc.). 3) This is a CA certificate which is used for communicating with the WPA-Enterprise authentication server. 4) This is a CA certificate which is used for communicating with the WPA-Enterprise authentication server **and** for MITM introspection. Note: In case (1), you will be able to connect to the Wifi network without installing the certificate but all (or most) websites will be blocked with a "untrusted certificate" error. In case (2), you cannot connect to the Wifi network at all and probably cannot even configure the connection to the Wifi network. If we are in case (2), you are *probably* safe as long as the certificate is installed as a trusted server certificate and not as a CA certificate. (Although, the way this is handled probably depends on the operating system and I don't have much experience of macOS). Case (2) is a legitimate use case and as long as the certificate is not installed as a system-wide CA, but only for this Wifi connection, you should be fine. According to the file name ([WebScreen](https://webscreen.lgfl.org.uk/UserManual/overview.html)Cert), **I assume that we are in case (1)**. In the rest of this answer, I'm assuming we are in case (1). --- Your school wants you to install a certificate **associated to a private key they control** so that: * they might be able to inspect all your TLS communications while you are using their network; * (possibly) they might be able to filter/block some communications. The immediate consequence is that the school administrators **will be able to see everything (note: I am simplifying a little bit) you do on internet while you are using their network**. If you are worried about this, you should probably avoid doing anything that you would not want them to see while you are using their network. Even if you do this, you are not safe! A (malicious) actor which gets access to the private key (such as a malicious network administrator of your school or a hacker which would have hacked the school) might be able to: * inspect your communications (eg. see the password you send to remote website, see the session cookie on all websites visited - which makes it possible to steal your sessions, see your emails, etc.) (for example, if you connect to a malicious Wifi network or a shared WPA-personal Wifi network); * modify the data you receive from the internet (or send to internet); * potentially attempt to use this to install malicious programs into your computer (by modifying the programs you download such as when you are updating your programs, unless all your software downloads/updates are signed). If any of these worries you (it should!), you could use a separate browser profile (typically using Firefox) and configure the certificate only in this browser profile: * While you are in your school network, you should use this browser profile and avoid doing anything suspicious. * You should not login on any website using this browser profile on any website (unless you do not care if your account and password is stolen). * You should not download any program using this browser profile. * But you will not be able to use many other network-connected programs while you are using the school network. * While you are not in your school network, you should use your main browser/browser profile. Note: I am suggesting using Firefox because it uses a separate list of trusted CA certificates for each profile. As far as I known, all the other major browsers use a single user-wide/system-wide list of trusted CA certificates. (TODO, I believe Firefox is using some digital signature when downloading updates so that the school certificate could not be exploited to install a malicious version of Firefox using the update mechanism.) --- Another solution would be to: * install a dedicated virtual machine; * install the certificate system-wide in there only and only use this virtual machine when you are using your school network; * do not do anything you do not want someone to see on this virtual machine; * do not do login on any website/account you care about using this virtual machine.