You will need to create one or more digital certificate(s) on the appliance. These certificates can be self-signed or CA signed. Please go to Administration - Certificates to create these. Refer to the product manual if you need additional assistance.
Once the certificates are created, you will need to enable TLS on either the Inbound MTA, Outbound MTA, or both. You can accomplish this in Administration - Host Configuration - SMTP. You'll need to check the box to enable TLS and select the certificate from the drop down list. Once you click on Save, your appliance will be ready to receive TLS encrypted messages.