We use Sage CRM internally and I've wondered about this too, many times.  CRM contains sensitive confidential information and should absolutely be as secure as possible. 

Not having guidance on how to use HTTPS with CRM seems like a major gap in core documentation.

https://community.sagecrm.com/knowledgebase/w/onpremisekba/616.492-15895-how-to-using-ssl-between-crm-and-sql-server.aspx

The link provided by Kannan was to secure the connection between CRM and the SQL database. I think the OP is asking how to secure the connection between client browser and CRM server.

IIS is Microsoft's web server, and CRM is a website served by IIS.

Normally you would get your IT to obtain and configure the SSL certificate on IIS. The basics are that you prove you have control over a domain name, a certificate is issued by a CA, then you bind the that certificate on a port. You then connect to your CRM site using https://

Microsoft's article on SSL for IIS for further information: https://support.microsoft.com/en-us/help/298805/how-to-enable-ssl-for-all-customers-who-interact-with-your-web-site-in