Pause all cluster nodes except one.

On the active node, enable encryption using the cluster certificate, then stop the local Management Server instance.

Move the role to the next node and repeat step 2 until you've enabled encryption on all nodes.