security - Can using self-signed certificates with WCF be secure? -

imagine moment we're using classic asymmetric encription wcf (private/public key pairs). it's secure until private keys aren't stolen. don't need trust chains between keys, right? client needs know server's public key , vice versa.

a problem arises if client doesn't know server's public key in advance , gets on first access. here have risk actual server "man-in-the-middle" instead of real server. here need certificates. client accesses server, gets certificate (which contains public key) , validates it.

for validation client needs make sure server's certificate issued particular server. , here need trust chains. right?

if client accessing server via wcf messagesecurity.mode=certificate knowns in advance server's certificate (its public key), can communication secure if certificate self-signed?

usualy it's believed using self-signed certifacate not secure , should avoided in production.
why? if client knows expected public key gets certificate, treats trusted (by matching public key expected one) doesn't cancel fact server must encypt payload private key. , cypher can decrypted successfuly pulbic key if , if private key , public key created together.

can see flaws in reasoning?

if it's correct can sure using custom x509certifacatevalidator , setting client proxy's clientcredentials.servicecertificate.defaultcertificate fixed (on client) x509certificate secure?

custom x509certifacatevalidator this:

public class customcertificatevalidator : x509certificatevalidator {     private readonly x509certificate2 m_expectedcertificate;      public customcertificatevalidatorbase(x509certificate2 expectedcertificate)     {         m_expectedcertificate = expectedcertificate;     }      public override void validate(x509certificate2 certificate)     {         argumentvalidator.ensureargumentnotnull(certificate, "certificate");          if (certificate.thumbprint != m_expectedcertificate.thumbprint)             throw new securitytokenvalidationexception("certificated not issued trusted issuer");     } } 

yes, understanding correct, misses 1 thing - things change on time. if server's private key disclosed or server's certificate becomes invalid in other way (whatever), pki offers mechanism certificate revocation , revocation checking. , self-signed certificates not possible (at least without building custom pki infrastructure).

one way address problem create custom self-signed certificate used ca certificate. use certificate sign server certificate , put revocation information ca certificate. add ca certificate trusted on client side, , perform validation of server's certificate against ca certificate , check revocation. means have either publish crls on (possibly private) web server, or run ocsp responder.