I'm writing an iOS app for private use to act as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate.
Since the server is self-hosted, on the first connection inside my LAN I could be pretty sure that no MITM attacks were happening. So I saved in a file the certificate that the server sent to the client and then I bundled the downloaded certificate inside my app to check on every connection if the certificate sent by the server and the one bundled in my app were the same (SSL Pinning basically).
I know very little about MITM Attacks and security in general so my question is the following: could an attacker download the certificate (like I did) from my server and use that certificate to pretend to be the server and perform a MITM attack? Or am I misinterpreting the way man-in-the-middle works?