SSL is a way of making a secure connection. The traffic is encrypted so that only the sender and receiver can see the actual information. HTTPS is ssl for HTTP. The endpoints agree to encryption and no one other than the server and client can see the info. SSL can also authenticate, using (hopefully) unforgeable certificates that prove that one side is who they claim to be.
Basic authentication has the password encoded. This means it's goes through a simple encoding transform (Base64) that is easy to reverse and see the real data. If someone has access to your network, or any network between your server and the client actually, they can see the base network traffic (the slang term for this is snooping, or sniffing) and easily see the username and password. If you use HTTPS, this is encrypted, and can not be seen.
To get https working, you need the https code in your server (from apt-get) and a certificate. The certificate tells people who the server is (the authentication above). You can either purchase a certificate, in which they'll ask you some info to prove some company or whatever, and sell to you. Or you can create a self-signed certificate for free.
To get the 'who are you' part of the authentication to work, they have a 'web of trust'. I can say i'm anyone i want, but how can i prove it? Well, if you buy a certificate, the issuer says 'I trust this guy is google.com'. And your web browser trusts the big issuers so they trust that they say you are google.com. But your self-signed cert will be trusted by no-one. So your browser will complain. If this is for internal intranet use, you can just tell them to ignore it. Internet users will be harder to convince, and you may eventually just need to buy one.
This isn't all free from a computing standpoint. Any https traffic will need to be encrypted. That takes CPU. Also, your content is essentially uncacheable, meaning more hits to your server. Check your server resource limits after the change.
Also, you didn't ask, but Basic Authentication isn't the best authentication. Besides the absolute need to encryption, there is no easy way to log out.