How to configure Mac OS X Server
Alternatively, you can also use a self-signed certificate created by OS X Server to encrypt traffic.
This will not automatically be trusted by devices until it is installed on those devices as well, so for a full deployment, the extra effort of getting a certificate signed by a trusted authority is worth it.