Does Self-signed certificate differ from CA from a security point of view?
Features
A self-signed certificate is capable of having the same security features (encryption, extended validation, permitted usage) as a certificate issued from a leading issuer such as VeriSign or GeoTrust. These options need to be set when the certificate is created.
Trust
However the purpose and the advantage of Public Key Infrastructure (PKI) (such as Internal Certificate Authority used inside an enterprise, VeriSign/Symantec, GeoTrust, and many more) is that there is an existing trust relationship between the client and the certificate issuer (e.g. VeriSign). The client (people and browser) trusts that the issuer has checked you out and has verified you are who you say you are. Certificate issuers have stringent security practises that they have to maintain. This type of relationship is not replicated with a self-signed certificate.
You can install a self-signed certificate into a browser (needs to be done for each browser) to make it recognise the certificate as trusted.
If you do not do this step the user has no way of knowing the certificate has changed unless they manually inspect the certificate. This could be dangerous because someone could intercept the transmission (man-in-the-middle) and the user would not know the certificate/host was the wrong one.
Summary
When looking at functionality alone, a self-signed certificate offers neither more or less security then one issued from a leading certificate authority.
Websites are for users, and a certificate trust is important so the user knows your website is who it says it is.
My personal opinion is that the trust and ease of deployment gained by using a public issuing authority is very important for a public web site, especially if you don’t have an existing close relationship with the people visiting it.
A self-signed certificate may be suitable for limited internal development / testing.
An internal Certificate Authority for use is a good solution for enterprises who use certificates internally and have an expertise in PKI.
Hope that helps
It's not secure, because it makes you vulnerable to a redirection or man-in-the-middle attack. Any attacker can create a self-signed certificate for your domain, and your users won't be able to tell that they've received the wrong one if they're taken to the attacker's site instead of yours.
As you already said, the browser will issue a warning to the user. This makes it possible to man-in-the-middle the connection. Certificates are about trust and your self-signed certificate lacks the trust-chain you normally get with a CA-signed cert. Consider this: if the client is going through my router to connect to your website, I can intercept the communication, generate a cert on the fly (for the client) and talk to your server using your cert. It would still look the same for the client but on my router I have the unencrypted traffic.