Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
The risks are for the client. The point of the SSL server certificate is that it is used by the client to know the server public key, with some level of guarantee that the key indeed belongs to the intended server. The guarantee comes from the CA: the CA is supposed to perform extensive verification of the requester identity before issuing the certificate.
When a client (the user and his Web browser) "accepts" a certificate which has not been issued by one of the CA that the client trusts (the CA which were embedded in Windows by Microsoft), then the risk is that the client is currently talking to a fake server, i.e. is under attack. Note that passive attacks (the attacker observes the data but does not alter it in any way) are thwarted by SSL regardless of whether the CA certificate was issued by a mainstream CA or not.
On a general basis, you do not want to train your users to ignore the scary security warning from the browser, because this makes them vulnerable to such server impersonation attacks (which are not that hard to mount, e.g. with DNS poisoning). On the other hand, if you can confirm, through some other way, that the certificate is genuine that one time, then the browser will remember the certificate and will not show warnings for subsequent visits as long as the same self-signed certificate is used. The newly proposed Convergence PKI is an extension of this principle. Note that this "remembered certificate" holds as long as the certificate is unchanged, so you really want to set the expiry date of your self-signed certificate in the far future (but not beyond 2038 if you want to avoid interoperability issues).
It shall be noted that since a self-signed certificate is not "managed" by a CA, there is no possible revocation. If an attacker steals your private key, you permanently lose, whereas CA-issued certificates still have the theoretical safety net of revocation (a way for the CA to declare that a given certificate is rotten). In practice, current Web browser do not check revocation status anyway.
You may be securing your website with self-signed certificate to save your money and time spent in purchasing an SSL certificate from a CA. But the question here is “Are you really saving your money?”
You may receive an immediate benefit by cost saving but in long term you will realize that it is turning out into a costlier approach. Self-signed certificates secretly increases your expenditure in a way that it proves out to be costlier in terms of security hardware, software management, place of data center and much more.
Along with the hidden costs another severe drawback of self signed certificate is that it is not much successful in earning trust of visitors. Some web browsers like Google Chrome displays a warning regarding the uncertainty of the identity of the website.
As far as a public site is concerned, self signed certificate fails in winning the trust of the visitors and hence results in loss of business and reputation.
While for internal websites also using self signed certificate may invite unwanted threats as users avoiding warnings of the internal sites, starts ignoring the warning on public sites also.
A certificate purchased from a trusted Certificate Authority is the best when it comes to both security issue as well as reputation.
You will be presented with a security warning (unless your CA cert is installed in your browser). Unless you inspect the certificate and verify the thumbprint matches what you expect, you can not be certain you are communicating with the right server (DNS pinning can help, like how chrome wasn't vulnerable to the diginotar and comodo problems.
SSL is about protecting data while assuring identity. A self-signed cert can cause you to lose both benefits.
Also, getting in the habit of accepting certificate warnings will lead to badness. So from a psychological perspective, it should be avoided at all costs.
Also, using self-signed certs means the terrorists win (ok maybe not)