How does Android handle wifi root CAs? Should they be a security concern? My university requires me to install a custom root CA to connect to their wifi network. When I installed it on my phone, it let me specify "Wifi" or "VPN and apps". I chose wifi, and was able to connect successfully.

However, I'm concerned about the security of this certificate. I don't know who is responsible for it at my university, and whether it's a group of volunteer students who don't know what they're doing.

When I chose the "Wifi" option, does that mean the CA will only be used to authenticate with the wifi network and not for anything else? So if the private key gets leaked and someone tries to make a phishing site using HTTPs to target students, would Chrome/whatever browser I have installed accept an HTTPs certificate for a site signed by the CA I installed for wifi?

I'm on Android 7.1.1
A certificate authority signs digital certificates. Often times companies will pay an internationally trusted CA such as VeriSign or DigiCert to sign certificates on their own domain. 

In some cases it may make more sense to act as your own CA, rather than paying a CA like DigiCert. Your university is doing exactly that, ie using their own certificate authority. 

The first thing to understand is that the root CA that you installed is not a private key, but a public key. Take a look at your certificates on the browser you are using and look at the authorities tab, you will see a whole bunch of root CA such as VeriSign. 

So lets say your university has an informational webpage university.edu. With out installing the root CA onto your device if you were to go to the web page you would see an error warning you that the site is not trusted. After installing the root CA, the site will show as secure since it is verifing that it is valid using the public key on your device. The unversity.edu webserver will have a private key that correlates to the public key you have. So when you access the webpage it verifies it is a valid site. 

In essence having the root CA is not an issue. The only key that could potentially cause major issues if compromises is the root CA private key. Typically CA's are set up with a root CA and then an intermediate CA. The root key is kept offline so that it can not be compromised. That way if the private key used to sign Certificate requests on the intermediate CA is compromised, a new private key would be generated using the root Private key. This would require reissuing keys to all the servers that are verified, but does protect the environment. 

Hope this helps. 

Take a look at this documentation for setting up a certificate authority for more detailed understanding of how a certificate authority works.

https://jamielinux.com/docs/openssl-certificate-authority/introduction.html