You use tools to generate safe DH groups for you, so you don't generate them entirely randomly. These tools put them through strict tests which ensure they do not have properties which make them unsafe. The tests are so accurate that the probability that one of the chosen parameters will be insecure is exceptionally low. There are two types of generators, called 2 and 5. The default is 2, but you can read about the differences here. The generation goes roughly like this:
- The DH group generator creates a list of random candidates. They are all completely random, taken from your system's entropy pool so you can be sure that they are not maliciously selected.
- The generator puts each candidate through extensive tests and discards the majority, leaving only a few which have special properties that make them safe for use.
What NIST did is use the pi for the first step, because obviously you would not trust them if they told you that they used their own randomness, because they could theoretically backdoor it otherwise. This safely turns the first step into a deterministic one.
Now, you don't have to worry about you creating the groups your self, because the generator gets entropy from your own system's entropy. This stage is non-deterministic, which makes the pre-computation attacks which weaken DH no longer a problem.
The reason you should use your own DH groups is because it makes you more secure from attacks involving pre-computation. The reason you should not use your own DH groups is because generating them is computationally heavy and if you are using a very very old computer, it may take a long time to create them. But as long as you generate them using openssl dhparam, then you will not need to worry about bad DH groups.
