AlwaysOn Availability Groups and Encrypted Channels
You can simply enable SSL on each replica as per normal, but the certificate you provision should have a CN that matches the Listener name that you're connecting to.

See here for more info.