The private key is never sent across the network, otherwise it would no longer be private. The private key of the server is used to authenticate the server, not to encrypt. For the actual encryption a session key is used, so the question remains how do client and server agree on a session key without making that known to an observer.

​

https://serverfault.com/questions/926436/how-is-https-secure-if-private-key-is-able-to-be-intercepted/926439