I have a mail server that has a self signed SSL certificate.
I use Thunderbird to access this server, and it asks me to accept this certificate.
So lets say I accept this in a semi secure location, for example on a local network. Then move on to an insecure net with my certificate accepted in Thunderbird email client.
Thunderbird is set to use STARTTLS to the email server.
Is it so that once this certificate is accepted, it is impossible to do a man in the middle attack. For somebody to make use of this public self signed SSL certificate they also need a private key that the mail server keeps?
The red flag is if Thunderbird one day suddenly wants me to accept a new certificate from the mail server.