Unfortunately, the word certificate refers to different things in similar contexts. Even within TLS/SSL, it can mean (at least) either:
- A server / domain certificate
- A CA (Certificate Authority) certificate
- A client certificate
Most likely you've never used a client certificate. These are installed in your browser, and authenticate the browser to a certain server. Virtually all websites use passwords to fulfill this function, instead.
A server certificate authenticates a certain server to your browser - it makes your browser sure it's talking to the correct server, and not a impersonator server. Each server or domain usually uses a different certificate, so a server certificate is only valid there. Since there are many millions of servers and domains on the internet, your browser cannot possibly be shipped with certificates to all of them. Anyone can generate any (so called self-signed) certificate for any domain another way is needed to establish trust. This is where CAs come in.
CAs act as a trusted third party: they have broad authority to assert the identity (server certificates) of all the internet domains. This authority is granted by the browser developers, which ship their certificates built-in the browsers
Now that we know a bit more about TLS certificates, we can answer your questions:
the questions below suggest that
trusting ONE certificate would put everything you do online at risk.
This is true if it is a CA certificate - not a server certificate. The procedure to install them varies. Since a CA is able to identify ANY domain on the internet, if you install a "bad" CA, all your browser-based communication can be immediately compromised.
I have trusted self-signed certificates more than once from many
websites because they simply can't afford to pay for a certificate.
Does this mean everything I do is vulnerable to MitM?
No. These are server certificates, are are only valid for the domain(s) they are issued to. You can see this information if you inspect the certificate details. Your browser may actually accept the certificate as valid for the domain you're visiting on even if it's different from the domains listed in the certificate, but it doesn't affect any other domains.