Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
Certificates are used to verify the identity of the remote end of a connection. You can think of them like picture IDs or driver’s licenses.
A certificate is not an active thing. Certificates cannot spy on anyone.
Like a driver’s license, a certificate shouldn’t be easy to counterfeit. If a certificate is issued by a reputable service, it can’t be.
But if you self-sign it, you aren’t a reputable service. You may trust it, but nobody else should.
A self-signed certificate is fine for protecting your own private communications, but is worthless to prove your server’s identity to anyone else.