AFAIK, using self-signed certificates on public usage has following problems.
Cannot verify its authenticity on the first-time key exchange. However, if first key exchange was successful, following communication would be secured by comparing stored server cert. on clients.
If cert.'s private key is stolen, cannot revoke that cert.
If they are all the risks of self-singed cert, in the following situation, I think it is not that bad to use self-signed cert.
All the clients are managed. So if the cert's private key was spoiled, I can remove all the previous certs on all clients and re-new it for new self-signed cert manually.
I can pre-install self-signed cert to clients by offline before its first communication to server. So there's no risk of accepting fake cert on first handshake.
In this circumstance, is it okay to use self-signed certificate? or there still have important reason to use CA-signed certificate?