Is this a correct SSL explanation in layman's terms?
A TLS/SSL connection is possible if both the Web server and the Web browser are configured to recognize the same root certificate authority (CA).  Basically it's like the server telling the browser, "Such-and-Such root CA, or one of its subordinates, says that I'm OK" and the browser responds, "Any friend of Such-and-Such root CA is a friend of mine.  Trusted!"