Which part of a self-signed certificate can be trusted?

Public and private keys are linked in such as way that if two certificates have the same public key, they were created using the same private key.

So if you assume that the private key is indeed kept private, the part you can trust in the certificates to identify the creator is the public key, and by extension the digest of the public key.


If two self-signed certificates have different public keys you cannot determine if these certificates were created by the same person or not.

If two self-signed certificates have the same public key you at least know that the same private key was used to create the certificates. If you assume that this secret private key is only known to one person you can deduce from that the same person has created both certificates.
If you instead must assume that multiple persons might have access to the same private key then you at least know that one of the certificates was issued by one person in this group and the other by the same or different person from the same group.