The SSL/TLS specifications dictate the over-the-wire protocol, but they say nothing about how a client is implemented. Typically, the operating system kernel provides a basic unencrypted TCP socket. To implement the SSL layer, the browser calls functions in a cryptographic library (such as OpenSSL, SSLeay, GNUtls or NSS). Thus, the SSL support would typically happen in userspace, in the same process as the rest of the browser.
As for whether you consider the SSL support to be provided by the "system" — it depends. The browser may link to the cryptographic library statically or dynamically. A dynamic library (or DLL) could be distributed with the operating system, or the browser vendor may ship its own copy of the library.
On the server side, the situation is often similar, where a web server module provides SSL support (in userspace, in the same process as the rest of the web server). However, alternative setups are common as well. Cryptographic support may be hardware accelerated. A reverse proxy, such as a load balancer, may sit in front of the real web server and translate between HTTP and HTTPS, in which case the data may travel unencrypted within the content provider's network.
To address the concern of data interception and tampering: Anyone who has access to the server's private key can easily decrypt the transmission. As a corollary, any server that presents a certificate that is signed by a certificate authority trusted by your browser can spoof the website, as long as the hostname on the certificate matches the hostname in the URL. (For example, Opera operates a proxy for its Opera Mini product. The Opera Mini browser funnels all traffic through Opera's proxy and fully trusts the certificate presented by the proxy. Therefore, although traffic between the browser and the proxy may be encrypted, and traffic between the proxy and the content web server may be encrypted, Opera has the technical ability to read all of the data going through its proxy.) Finally, anyone who has the ability to tamper with the browser (by some extension or plugin mechanism) or the dynamic linker (using something like LD_PRELOAD) or the browser's trusted certificate list could also intercept the data, though at that point the client's integrity has been so compromised that there is no hope for any meaningful security.