SSL/TLS is a protocol which allows the use of several algorithm combinations (cryptographic suites), for key exchange, authentication, encryption, integrity protection. The answer on your question depends on which one is used. During session startup, client and server negotiate which algorithms will be used.
All of them rely on authentication of at least one side (normally the server) to avoid man-in-the-middle attacks.
The main communication will be encrypted symmetrically. Here are some ways to get the symmetric key:
- The client chooses the session key (or some important part of it) randomly, and encrypts it with the public key of the server. The server then can decrypt it.
- Client and server use the Diffie-Hellman key exchange algorithm to get a key, and after this the server signs the resulting key (and other session parameters) by its private key (which can be checked by the client).
In both cases, the client has to check the certificates of the server to ensure that it really speaks to whoever it thinks to speak to.
In the case of client authentication, also the client has to sign the session data so the server can verify it.
In these signature schemes, each signing party has a certificate which links the public key to some other information, which the other party can use to verify that the key pair belongs to the right owner.
There are also certificate-less authentication (and key exchange) schemes, like password based authentication in SRP. Still, without authentication of at least one side it will not work.