DPI Fortigate?? - Certificate Deploy Mobile Device to School

First, my English is bad, I used Google translate.

I have implemented fortigate devices with content filtering and it works fine. Right now I am implementing a 60F in a school, and the content filtering works great when I apply DPI (I have to install the certificates). I understand that with GPOs I can distribute certificates to computers. But in this school the students carry their cell phones and need to access the network. To block traffic or even enable safesearch I need to install certificates on those mobile devices. How can I do this in the simplest way? I know I can enable DNS redirects for safesearch to work, but I WANT TO USE the full filtering that fortigate offers me. The number of mobile devices is large, so I would like to enable a site where the same students can download the certificates without the intervention of IT staff. Is it a very complex option? because nowhere have I found an answer to this.