First set up your certificate in the SSL tab of NPM. You can either upload a traditional certificate or set up LetsEncrypt. Be aware that starting next sprint the maximum length of a certificate will drop to 9 months and continue to decrease over the next few years until its 47 days.

I have mine set up so LetsEncrypt gets a wildcard cert for my domain (via DNS challenge). Some people go with per subdomain certs.

Once you have the cert, go you each of your hosts and switch to its SSL tab. Then select your cert. Then I usually turn on “Force SSL”