Only a trusted and legitimate Certification Authority (CA) can issue an SSL Certificate. Browsers maintain a list of their trusted CAs and only trust the certificates that are issued by them. It’s like when you apply for a loan in a bank, it asks for a guarantor who has his account in that bank and is therefore trusted, to vouch for you. Similarly, here CA acts as your guarantor, who confirms that you (a site applying for SSL) are authentic (following different levels of testing) and can therefore be trusted.

For the e-commerce sites, the CA’s certification guarantees consumers that the site in question is legitimate and its existence as well as the domain is vetted by the CA itself. If the certification is not trusted, the browser displays “untrusted certificate” error message to the user.                   

               Error message with IE                                Error message with Firefox