Ideally, the connections from the Internet to your front-end and the connections from your front-end to back-end both need to be protected using SSL. Whatever is serving your front-end / back-end applications would most likely support SSL termination. Your front-end is most likely served by a web server like Nginx or Apache. You need to get the web server to listen over port 443 and setup SSL there.
If your back-end application is secure and isolated behind a firewall, and if (and only if) it's configured to receive traffic only from your front-end application, you can optionally skip setting up SSL between the applications. This is NOT recommended, however. Certificates are cheap if not free these days and you should aim to set it up wherever possible. There are even performance benefits to this and this lets you use fast, modern transport protocols like HTTP/2 or SPDY.
Depending on your setup, you could even terminate the SSL at the load balancers if you use them. May I ask why your back-end app is open to Internet?