Install a server certificate on each Delivery Controller and bind it to port 443.
Securing the XML service requires a valid SSL/TLS certificate bound to the XML listener, so that StoreFront and other components communicate over HTTPS instead of HTTP.
Disable the port 80 listener on each Delivery Controller.
To enforce HTTPS-only connections, you must turn off the default HTTP (port 80) listener on every Delivery Controller once the SSL binding is in place.