Big thanks to StartSSL for getting me set up with a signed certificate. Their FAQ on configuring with openssl and nginx worked like a charm. I even got a handy email from them after I thought I was done, telling me that I needed to concatenate the certificate they gave me with a sub cert and root cert for the chain of trust to work properly.
Honestly, the hardest part was making WordPress work properly and to update links to avoid browser warnings. I got most of the way there by using the search and replace plugin – one needs to be very careful with that tool, however. For example, post GUIDs should never change, even if changing the hostname that WP is running on.