The official truth, which for once seems believable, is:
because strong encryption can be so effective, classified N.S.A. documents make clear, the agency’s success depends on working with Internet companies — by getting their voluntary collaboration, forcing their cooperation with court orders or surreptitiously stealing their encryption keys or altering their software or hardware.
So, the NSA has the private key that is used by your https server. The question then is, how?
If you leave the front door wide open, and you find your house has been burgled, it is possible that the burglars have a super secret underground tunnel that comes up into a well hidden trapdoor in your basement.
But chances are that they waltzed in through the wide open front door.
And by “wide open front door” I mean the common practice of the certificate authority making up your secret key for you and sending it to you.
Snowden, who knows what the NSA is up to, tells us:
Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on.
Trouble is, seldom properly implemented.
Strong, non human memorable, secret keys should be created in place on the device that their corresponding public key identifies, and never leave that device. There should be no user interface and no best practice procedures for managing such secret keys, only for managing the corresponding public keys, which should be presented to the user as guids or something like a guid, as something like a vin number. The way a sysem administrator should perceive setting up an https server is that the server makes up a guid, and he then gets a certificate from the certificate authority saying that the guid is good for his organization and/or domain name, and installs the certificate for the guid on the server. He should not need to know or think about private keys.