Why Schools (and Businesses) Install Security Certificates on Devices

Schools are increasingly asking parents to install a security certificate on devices that connect to the school network. This isn’t unusual or invasive — it’s a standard approach used across corporate networks, public-sector environments, and managed educational systems. This article explains why the certificate is required and how the underlying technology works, without oversimplifying or assuming prior knowledge.

How the Web Worked Before Encryption

In the early days of the web, most websites used HTTP — HyperText Transfer Protocol.
HTTP sends data between a web server and a browser in plain text. That means anyone on the same network could read it, including logins, messages, and anything typed into forms. It functioned adequately at the time, but it wasn’t private or secure.

The Move to HTTPS and Encrypted Connections

To address this problem, the industry shifted to HTTPS — HyperText Transfer Protocol Secure.
HTTPS adds encryption through:

SSL — Secure Sockets Layer, and
TLS — Transport Layer Security

This encryption creates a secure channel so that only the browser and the website can read the contents. Intermediaries — such as Wi‑Fi operators, ISPs, or attackers on the same network — only see unreadable encrypted data.

This is why browsers display a padlock icon: it signals that the connection is encrypted, and that the website proved its identity using a digital certificate.

What the Padlock Actually Guarantees

The padlock symbol indicates three things:

Encryption – The data in transit is scrambled and unreadable to observers.
Authentication – The website supplies a certificate confirming it’s the legitimate owner of the domain.
Integrity – If the encrypted data is tampered with, the browser detects it.

This trust works because every device contains a built‑in list of “root certificates” — essentially a set of authorities the system already recognises as legitimate.

It’s important to note that malicous websites can have padlocks - your are connecting securely to someone you cannot trust.

Why Schools Need Their Own Certificate Installed

While encryption protects privacy, it also creates a challenge for networks that need to enforce safety policies. Modern safeguarding, malware protection, and content filtering systems rely on inspecting web traffic. As more sites adopt HTTPS, traffic becomes unreadable to these systems unless the device explicitly trusts the school’s inspection process.

Without installing the school’s certificate:

harmful or inappropriate content may bypass filters,
malware hidden inside encrypted traffic becomes invisible, and
safeguarding systems cannot detect concerning behaviour.

By installing the certificate, the device effectively says:

“I trust the school’s filtering system to inspect encrypted web traffic while I’m on the school network.”

This only applies on the school network and only to web traffic, not to personal files or anything stored on the device.

How Encrypted Traffic Is Safely Inspected

Here’s what happens technically when a device with the certificate installed visits an HTTPS site on the school network:

The device attempts to create an encrypted connection to a website.
Instead of connecting directly, the traffic is routed through the school’s filtering system.
The device establishes an encrypted connection to the filtering system, which it trusts because of the installed certificate.
The filtering system then establishes its own encrypted connection to the website.
It briefly decrypts the traffic to scan for harmful content or threats.
The traffic is re‑encrypted and passed on.

At all times, the data remains encrypted — it’s just being encrypted in two hops rather than one.
This allows the school to use modern security and safeguarding tools without weakening the encryption itself.

Why This Approach Is Necessary

Schools are required to:

block harmful or illegal content,
protect students from online threats,
detect safeguarding concerns,
prevent malware or phishing attempts, and
monitor for risk while on school‑managed networks.

With most internet traffic now encrypted, these protections cannot function unless the filtering system is allowed to examine the data in a controlled, trusted way.