I understand the risks of a self-signed certificate used to enable HTTPS on a server.
My question, however, is about HTTPS client certificates.
Imagine the following scenario. I want to be able to authenticate a bunch of tech-savvy users on a public website without requiring them to pass through OpenID or requiring a password.
I start by generating a self-signed root certificate that I store on the server. In the context of this question, let's assume this root certificate will be protected against hackers.
From this root certificate, I generate several client certificates, one for each user, and transmit the .p12 file to those users in a safe way. They add those certificates to their browsers, and can now be authenticated.
Is there any security issue that the root certificate was self-signed? How would this compare to, for instance, using Let's Encrypt derived certificate as a root certificate (which is possible to do, since I do have the private key on the server as well)?
It seems to me that in terms of certificate revocation, it is as simple as regenerating the certificate, would it be the root certificate if this was the problem, or a client certificate. Is there anything else I'm missing?