Always On Availability Groups with Encrypted Connections
First for an AG you need to Force Protocol Encryption on each instance participating in the AG.  With an FCI there is only one instance.

Also with an AG clients can connect to the AG Listener, and they can connect to the instances directly.  So you have to configure the certificates accordingly.  See https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/listeners-client-connectivity-application-failover#SSLcertificates

Note, that this configuration is not required to have protocol encryption.  It's required to authenticate the SQL Server to the clients.  If you merely want protocol encryption, clients may always request it, or you can force it on the server with a self-signed certificate.