lighttpd doesn't support TLS on backend connections.

If the backend needs to know whether the frontend connection was made with TLS check the X-Forwarded-Proto header.

If you need an encrypted connection to the backend (due to an untrusted network), use a VPN.

If you wanted end-to-end encryption to the backend you need a TCP proxy (haproxy can route connections based on SNI), or just forward it with iptables and DNAT.

Normally you create a new config file /etc/nginx/sites-available/newserver.conf for the new server and link it from /etc/nginx/sites-enabled.
To use nginx as reverse proxy, you configure SSL in nginx (ssl_certificate, ...) and in the location section you use proxy_pass to the non SSL server at localhost. proxy_redirect is also needed, but that only modifies the Location header in case your non SSL local server sends one.
You find an example in the following article.

Multiple http servers on localhost using different ports

server {
    server_name mydomain-01.com;

    location / {
      proxy_redirect http://localhost:8001 https://mydomain-01.com;
      ...
    }
}
server {
    server_name mydomain-02.com;

    location / {
      proxy_redirect http://localhost:8002 https://mydomain-02.com;
      ...
    }
}

Single http server on localhost using hostname based sites

server {
    server_name mydomain-01.com;

    location / {
      proxy_redirect http://s1.localdomain:4000 https://mydomain-01.com;
      ...
    }
}
server {
    server_name mydomain-02.com;

    location / {
      proxy_redirect http://s2.localdomain:4000 https://mydomain-02.com;
      ...
    }
}