Just like enterprises, they get you to install their CA cert as a new trusted root and then they sign their own certs for each domain as they flow through. Corp

Just like enterprises, they get you to install their CA cert as a new trusted root and then they sign their own certs for each domain as they flow through. Corporate IT will just push it through AD or pre-configure it, I'd assume campus IT gets you to run an executable to install it. Since all the traffic will be signed by them you won't get very far without accepting their root.