Perhaps a shared SSL certificate would be the way to go. Although, for me it would be easier to set up htaccess.

.htaccess would be encrypted if it was using digest authentication with a browser that supports it (which the newest Firefox and IE both do). It wouldn't encrypt the information being sent back and forth, but at least the authentication would be encrypted (not the admin login, but that login would just be a red herring then). I'm just wondering if adding that to the admin directory would be enough to secure the store management side. It seems to me that it might... but is there anything malicious that could be done using HTTP to access files that are anywhere other than inside the admin directory?