I'm looking at ways an outsider (i.e. someone without a possible password) of the network could sniff the communication within the network, specifically focusing on WLAN.

This is what I understand about wireless network security:


When we connect to an open wireless access point (so, with WEP) it is possible to sniff the communication (but we can't decrypt SSL-encrypted connections).
To make it impossible for outsiders to sniff network, we could use WPA(2) or the like, but in any case this will require to password-protect the network.


This is what I understand about SSL:


When we use for example HTTPS (so HTTP with SSL), it isn't possible for attackers to see the data that is being communicated over the connection (unless a malicious certificate has been trusted).
When we connect to a server using HTTPS, we do not need to enter a passphrase.


Say I'd like to create an open Wi-Fi hotspot that encrypts the data in such a way that no one can sniff the communication of other users of the hotspot. This is, as far as I know, not possible (is that correct?). But then, why isn't it possible to encrypt the communication with the wireless access point using a technique like SSL? SSL doesn't require a passphrase, but guarantees nobody can sniff the line. Is there something essential about SSL that makes it impossible to use it for such an application?

OpenSSL s_client
To check if you have disabled the SSLv3 support, then run the following
openssl s_client -connect example.com:443 -ssl3

which should produce something like
3073927320:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1258:SSL alert number 40
3073927320:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:

meaning SSLv3 is disabled on the server.  Otherwise the connection will established successfully.
Nmap
Alternatively, you can use nmap to scan server for supported version:
# nmap --script ssl-enum-ciphers example.com
Starting Nmap 6.47 ( http://nmap.org ) at 2014-10-15 03:19 PDT
Nmap scan report for example.com (203.0.113.100)
Host is up (0.090s latency).
rDNS record for 203.0.113.100: edge.example.com
Not shown: 997 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
| ssl-enum-ciphers: 
|   **SSLv3: No supported ciphers found**
|   TLSv1.0: 

