Operating a secure server addresses two issues: proving that you (the server operator) are who you say you are, and preventing data from being intercepted and
decoded by a less than nice person. The certificate authority is a company such as Verisign and Thawte. Their role is to grant the certificate to the site operator, and
in doing so guarantee to the visitor to the site that they are in fact at a site owned and/or operated by the company that purchased the certificate.
Unlike requesting a regular (http) web page or script, the browser and server must go through a few gyrations before anything can happen of interest to the reader.
Here is a simplified outline of how the SSL connection is made.
The major difference between secure and unsecure pages is the service name. Notice the "s" in "https"? This indicates a call to a secure
server instead of an "insecure" one. ;-)
A lot of folks seem to confuse the concepts of site security with secure servers. One would hope that a secure server (one that uses SSL to communicate) is also
somewhat secure from intrusion. The truth is that there is that a secure server will run just fine on a server with little or no security (in the sense of intrusion
prevention) on it!