As far as I understand, the only vulnerability happens when a user
logs or signs up from an unencrypted network (such as a coffee shop)
and someone is listening the network.
This is not true, data transmitted between the user and your website is never safe. Just as an example, http://www.pcmag.com/article2/0,2817,2406837,00.asp details the story of a virus that changed people's DNS settings. No matter how good your current network is protected, any submission on the internet goes through many different servers before it gets to yours. Any one of them can be malicious.
SSL certificates allow you to encrypt your data in a one way encryption that can only be decrypted at your server. So no matter where the data hops on it's way to your server, no one else can read the data.
In most cases, and this depends on your hosting, installation of a certificate is rather painless. Most providers will install it for you.
SSL Cert Types
As noted in some answers, you can create your own SSL certificates. An SSL certificate is just a public and private key pairing. Your server gives out the public key, the client uses it to encrypt the data it's sending, and only the private key on your server can decrypt it. OpenSSL is a good tool for creating your own.
Signed SSL Certificates
Purchasing a certificate from a certificate authority adds another level of security and trust. Again, it's possible that someone can sit in between the client browser and you web server. They would simply need to give the client their own public key, decrypt the info with their private key, re-encrypt it with your public key and pass it on to you and neither the user nor you would know.
When a Signed Certificate is received by the user, their browser will connect to the authentication provider (Verisign, etc.) to validate that the public key they received is in fact the one for your website and that there has been no tampering.
So, yes you should have a Signed SSL certificate for you site. It makes you look more professional, gives your users more piece of mind in using your site, and most importantly protects you against data theft.
More info on the Man In The Middle attack that is the core of the issue here.