Why do we think SSL is good?

Question

I know that SSL encrypts data so that the ISPs can't access it, but we are implicitly letting another source like letsencrypt.org that verifies openssl certificates to be able to decrypt the data. How can this make data transfer safer? I mean I created my own SSL but browsers don't accept it as a valid certificate and we are enforced to use a third party certificate. This only means that we let another company to control over our private data transfer. What makes SSL certificate companies not to sell our private key?

I'm not a native English speaker nor a programmer, please edit my question to be more accurate.

Answer 1

What makes SSL certificate companies not to sell our private key?

The SSL certificate authorities never have access to your private key. Nobody but you does - that's why it's called "private".

When you submit a Certificate Signing Request (CSR):

Before creating a CSR, the applicant first generates a key pair, keeping the private key secret. The CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509 certificate) which must be signed using the applicant's private key. The CSR also contains the public key chosen by the applicant.

So the private key signs, but is not itself sent to the CA.

Answer 2

What makes SSL certificate companies not to sell our private key?

SSL certificate companies (also know as certificate authorities, or CA's) do not have your private key. The certificate signing request (CSR) that you send to a CA contains your public key, and a digital signature that proves that you are in possession of the private key corresponding to that public key. But, it does not contain the private key.

I created my own SSL but browsers don't accept it as a valid certificate and we are enforced to use a third party certificate.

That's a good thing. If your browser accepted just any certificate, then what would stop an attacker from creating a certificate for your site, and MITM'ing your site?

With regard to openssl, are you confusing openssl (a program which is used to implement SSL/TLS) with a CA?

With regard to the overall sentiment of your question: Yes, we put our trust in CA's. Most of the time, CA's do what we expect, but there have been instances where they've failed. See If an adversary took over a major Certificate Authority, what bad things could they do? for some interesting reading on this subject. Also, see https://moxie.org/2011/04/11/ssl-and-the-future-of-authenticity.html for some ideas by cryptographer Moxie Marlinspike on how we might be able to rely less on CA's.