Distributed search uses each search peer's splunkd REST port, which is by default encrypted using SSL. Unless you went out of your way to specifically disable Splunk's SSL support, it should be encrypted already.
That said, the default out-of-the-box Splunk setup either generates a self-signed certificate or uses one provided with Splunk. Either way, it's not the most robust from an SSL point of view. You can (and should) generate your own key and CSR and get a new certificate issues for production installs. (It doesn't have to be a "commercial" CA - you can use an internal CA for the purpose. The point is to not just use the default certificate. )
