As long as you have a certificate, you're done. The public key is what tells the browser that this is the right server. It prevents people from posing as somebody else. And that is done through a digital certificate that is for the most part coming from VeriSign these days. There aren't a whole lot of certificates on the clients today because of distribution issues and infrastructure problems.
Most sites say a password is enough.
It's really up to the business to decide. SSL 1.0 was just a specification. It was basically something that was out for comments. It never shipped in any product. Nobody ever had a transaction using SSL 1.0.