What you want is "Upstream SSL".
This is when you re-encrypt the backend connection with Nginx. You don't need to buy another certificate. You can use self-signed certificates for the backend.
Discussed here: StackOverflow: Nginx load balance with upstream SSL
and here: ServerFault: Configure Nginx as reverse proxy with upstream SSLServerFault: Configure Nginx as reverse proxy with upstream SSL
Blog here: "SSL Offloading, Encryption and Certificates with NGINX (Archived here.)
They insist on calling this "End-to-End" encryption in their blog. (It maddens me that they do that. If you re-encrypt, then you're no longer end-to-end encrypting.)
(But Citrix is guilty of the same terminology sin with their "NetScaler" loadbalancer. (Archived here.))