Configuring check_nrpe and NRPE daemon with --enable-ssl generates a DH key pair. Are these DH keys enough to establish SSL connection? Or do we need certs and keys signed by a CA? Docs say certificates CAN be used for security.
SSL/TLS can support sessions that do not require X.509 certificates, such as anonymous Diffie Hellman, but it's very unlikely that you'll come across real world implementations that use it - for a start there is no authentication with this cipher suite.
There is documentation here that describes the process needed to configure TLS in Nagios. The Terminology section has:
To implement SSL you need to generate a certificate. When you generate a certificate, you create a request that needs to be signed by a Certificate Authority (CA). This CA can be:
A trusted company like VeriSign
An internal CA that is part of your IT infrastructure, like a Microsoft Windows CA
The Nagios Core server itself (self signed)
Therefore, depending on the level of security/convenience you need, you might get away with a simple self-signed certificate.