Private Diffie/Helman Tokens

Diffie/Helman is completely orthogonal to X.509 certificates – a certificate, e.g. from LetsEncrypt, is used to prove your identity, whereas D/H is used for key exchange when encrypting communication.

So yes, you don't need LetsEncrypt to encrypt internal communication, but you do need LetsEncrypt (or some other CA) when you securely identify yourself ("you" being an Internet host) to other entities *even* if no encrypted communication is going to take place.