You can create a common shared secret without transferring it over the network. Read on RSA and Diffie-Hellman key exchange in Wikipedia or other sources to get an intuition on how this works. You can even do a simple test computation by yourself (but it is only secure for extremely large numbers and several minor modifications).
Once you understand this, you may want to have a look at the (equally simple) Man-In-The-Middle attacks against these algorithms (probably also on wikipedia). To prevent these, you need mutual authentication, e.g., by signing the DH/RSA public keys and letting the peer verify the signature.
This authentication in turn requires some common knowledge from the "signature issuer"(certification authority), but that information is not required to be secret. This final ingredient("root certificate") is thus simply shipped with each browser and there are extensive procedures for creating and accepting it.
So, as long as you trust these authorities whose root certificate your browser vendor put into your browser to issue correct authentication information(certificates), you will be able to create encrypted+authenticated connections. (encryption is close to useless if you don't know where you're connected to!)