There are two possibilities:
- this is a CA certificate used for TLS interception (MITM);
- this is a (non-CA) certificate of a authentication server used only for communicating to this authentication server in order to initiate the Wifi connection (WPA-EAP/WPA-Entreprise using either of EAP-TLS, EAP-TTLS, PEAP, EAP-FAST, TEAP, etc.)
If we are in case (2), you are probably safe as long as the certificate is installed as a trusted server certificate and not as a CA certificate. (Although, the way this is handled probably depends on the operating system and I don't much experience of macOS).
In the rest of this answer, I'm assuming we are in case (1).
Your school wants you to install a certificate associated to a private key they control so that:
- they might be able to inspect all your TLS communications while you are using their network;
- (possibly) they might be able to filter/block some communications.
The immediate consequence is that the school administrators will be able to see everything you do on Internet while you are using their network. If you are worried about this, you should probably avoid doing anything that they would not want to see while you are using their network.
But event if you do this, you are not safe. Any (malicious) actor which would get access to the private key might be able to:
- inspect your communications (eg. see the password you send to remote web pages, see your emails, etc.) (for example, if you connect to a malicious Wifi network or a shared WPA-personal Wifi network);
- modify the data you receive from the internet (or send to internet);
- potentially attempt to use this to install malicious programs into your computer (by modifying the programs you download such as when you are updating your programs, unless all your software downloads/updates are signed).
If any of these worries you (it should), you could use a separate browser profile (eg. using Firefox) and configure the certificate only in this browser profile:
- While you are in your school network, you should use this browser profile and avoid doing anything suspicious.
- You should not login on any website using this browser profile on any website (unless you do not care if your account and password is stolen).
- You should not download any program using this browser profile.
- But you will not be able to use many other network-connected programs while you are using the school network.
- While you are not in your school network, you should use your main browser/browser profile.
(TODO, I believe Firefox is using some digital signature when downloading updates so that the school certificate could not be exploited to install a malicious version of Firefox using the update mechanism)
Another solution would be to:
- install a dedicated virtual machine;
- install the certificate system-wide in there only and only use this virtual machine when you are using your school network;
- do not do anything you do not want someone to see on this virtual machine;
- do not do login on any website/account you care about using this virtual machine.