Amazon interview question

How would you secure a website beyond an SSL certification? How does SSL work?