That's not enabled by default, you first have to flip the "Encrypt All Sites Eligible" switch.