I use an apache reverse proxy to do exactly what you want, SSL and auth. I use digest auth. My library is at "https://my-site/library", so I have calibre set up with a prefix. I use port 9192 internally between calibre and apache. That port is not permitted through the firewall.
The section in the ssl-sites config file looks like:
Code:
<Location "/library">
AuthType Digest
AuthName "Whatever you want"
AuthDigestDomain /
AuthDigestProvider file
AuthUserFile path-to-file-for-digest-passwords
Require valid-user
</Location>
RewriteEngine on
RewriteRule ^/library/(.*) http://127.0.0.1:9192/library/$1 [proxy]
RewriteRule ^/library http://127.0.0.1:9192 [proxy]