The attacker secretly alters the communication so that it can result in losses. Without an SSL certificate, all the communication traveling from the webserver to the client is accessible, which makes it easy for intruders to target such type of unsecured communication.