Make sure that anything connected to your database is using an DNS entry to connect. If they connect directly to the AWS Endpoint, then you will have to manually update your application to connect to a "new" endpoint after it is created.
- Create a snapshot of the database.
- Clone the snapshot and enable "encryption".
- Restore the snapshot to an instance of similar configuration. Make sure you check your VPC, subnets, security groups, Parameter group, and Option groups.
- Update the DNS entry to point to the new instance.
- Stop the unencrypted instance.
- Verify the application still works.
- Delete the stopped unencrypted instances.
Enjoy!