A certificate is needed basically for two reasons:
1. the user has to verify that the site is actually run by you and not by somebody spoofing your site. Somebody could make the user believe he's clicking on your's sites "pay" button, and instead he's sent to a fake paypal site, or a real paypal site with a similar account.
2. once the browser knows that you are you, it can securely encrypt che connection. This is useful if your webapp also requires password login etc.
Note that encryption is also possible without a trusted certificate (i.e. verified by the 'certificate authority' mafia^H^H^H^H), but at this point, albeit almost impossible to decypher once established, it remains vulnerable to the 'man-in-the-middle' attack, intercepting the key exchange with your site, or simply a spoofing as described in point (1).
EDIT: when I said "the browser knows that you are you", by "you" I mean "you" the server, the webapp
