A certificate is signed. This means that it comes with its own security. The validity of a certificate comes from its being signed by a certification authority, not from the way you obtain it. During the first steps of a SSL/TLS connection (the "handshake"), the client must gain reliable knowledge of the server's public key; the client can do so in any way it sees fit, but it often involves finding a certificate path, i.e. a set of certificates culminating in a certificate that contains the server name and the server public key. In order to smooth operations, the server includes such a potential path in one of the handshake messages it sends to the client.
Validation of a certificate path involves verifying the signature over each certificate, with regards to the pubic key contained in the previous certificate (there are a lot of other things which are checked, too, see section 6 of RFC 5280 if you are really bored one day). The point of the signature is to protect against alteration and to demonstrate provenance. How you obtained the certificate is irrelevant; for that matter, it could have been delivered to you by the Devil himself, it will not impact security.
However, you still have to being somewhere. As alluded to above, the signature of each certificate in the path is to be verified with the public key contained in the previous certificate. How do we check the signature on the first certificate in the path ? For that, we need a trust anchor: that's a name-and-public-key which is known a priori, e.g. it is embedded in the client software (after all, you trust the software itself for not logging all exchanged data and your key strokes, so you can trust it as well with the storage of some public keys). Trust anchors are traditionally encoded as root certificates: these are not real certificates (their signature is dummy, or often a "self-signature" which has no function except filling the slot for a signature in a certificate format) but they still assume the external format (as a bunch of bytes) of a certificate.
The "root certificates" must be securely obtained, since they cannot be verified in any way; all your trust comes from them. Here is a peek of the (beginning of) the list of root certificates embedded in Firefox (that is, the certificates that Mr Firefox found fit to stuff into his browser and that I, being a lazy user, "trust" by default):