This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device.
https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm).
In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.
This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections.
There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.
No, it's not, and this attitude is a major cause of resentment among technical employees.
The "DLP" industry, in general, is a solution in search of a cause. If you can't trust your employees, you'll never be able to stop the determined ones.
Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing without cause.
(Yes, this practice sucks. But it’s the only way for them to implement the legally mandated filtering in a way they can guarantee it is working.)
https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Inte...