It's more of a preference and policy issue than it is anything to do with the StealthWatch functionality.
Some organizations take the approach that anything that is secured with a certificate should have a proper one signed by a trusted CA. However others say that since the only people interacting with the SMC are qualified security practitioners they know that accepting the self signed certificate is not a security risk in this case.
I lean towards the former camp but it does mean we have to increase our skills with certificates and CAs. Vendors could certainly do a better job at making it easier. I have at least a dozen very different methods for dealing with certificates just among the Cisco products I use. If I spend half a day wrestling with certificate configuration, that's half a day I'm not dealing with actual security issues.
