Answer
No, it is not required to use a certificate of authority (CA). Users may use a self-signed certificate, however this is only advised for test environments. Use a CA once ArcGIS Online is deployed in a production environment.
Using a self-signed certificate in a production environment may cause the following issues to occur:
• Warning messages notifying the user is trying to access an untrusted site in ArcGIS for Desktop and web browsers
• Printing from hosted services and accessing the portal from client applications may result in unexpected behavior
• The inability to open a federated service in the portal map viewer, add a secured service item to the portal, login to ArcGIS Server Manager on a federated service, and connect to the portal from Esri Maps for Office
Note:
Esri Maps for Office is able to sign in if the self-signed certificate is installed into the Trusted Root Certification Authorities certificate store on the machine running the Esri Maps for Office.