There are other vectors for MITM in SSL. For instance:
Using a weak cipher with weak hashing function (think DES with MD2, gasp...)
Using an outdated SSL version (eg SSL 2.0, which for some weird reason some sites support even now).
Using a client or server that does not do 1 or 2, but allow doing so (attacker can cause downgrade attacks and force the parties to use a weaker cipher/SSL algorithm, then cracking from there)
These allow an attacker to perform MITM by cracking the encryption or protocol itself, whilst still remaining transparent to the user or server.
And then, there are impersonation attacks with a SSL cert validated by a valid CA. The attacker gets a CA to sign his cert for the target site (which he doesn't own), then sits in the middle of the client and server, impersonating as the server to the client). However, this attack is rare and requires quite a bit of resources, such as a nation state forcing a CA to sign its MITM cert, or by compromising the CA itself (see the DigiNotar incident).