Is this a correct SSL explanation in layman's terms? I'm looking to provide a basic / layman's explanation of SSLs to clients and want to be sure it is correct. My explanation is below and would appreciate any feedback / corrections.

Basically, the SSL certificate provides a secure and encrypted connection between your web site’s server and the user browsing your web site. Without an SSL the data exchanged between the web site and the user can be intercepted, which includes the web site contents and any form submission details.
The contents of a web site you visit may NOT actually be the content from the site you are on if it has been intercepted, and the form details submitted may not only go to the owner of the web site, but to the hacker intercepting the transmission. Although the likelihood of this happening is low, it is still possible.

Is this correct, or am I missing something somewhere?
A TLS/SSL connection is possible if both the Web server and the Web browser are configured to recognize the same root certificate authority (CA).  Basically it's like the server telling the browser, "Such-and-Such root CA, or one of its subordinates, says that I'm OK" and the browser responds, "Any friend of Such-and-Such root CA is a friend of mine.  Trusted!"