When we go to websites that have generated certificates themselves you see this red screen that says do not go there!: 
However when it is trusted by some companies it's all good. So I have a couple of questions:
Are certificates that are generated by these companies somehow better/different?
If we take to account that NSA, for example, has every private key of these issuers doesn't it make private certificates actually more secure?
Generally speaking, you are the one who should decide who you trust and who you do not trust. However, this is a tiresome process; in its infinite wisdom, Microsoft (or Mozilla or Google or...) found it fit to include a set of "default trusted roots" that are used by Internet Explorer (or Firefox or Chrome or...).
In the case of Microsoft, the process by which a given CA may enter the inner circle of "trusted by default on most Windows systems" is called the Windows Root Certificate Program. In a nutshell, Microsoft requires that the would-be root CA applies strict and specific security procedures, and has insurance, and legally guarantees that Microsoft will never be blamed (in a financial way) for any mishap. PKI is only 5% technology, and 95% procedures anyway.
If you do not want to follow the Microsoft (or Mozilla or Google or...) road, you are free to adjust your own set of trusted root CA. That's up to you. However, in any case, as long as you use Windows, you trust Microsoft, in the sense that if they want to betray you then they can easily do it, and you would be none the wiser.
If a root CA is controlled by an enemy, then that enemy can issue fake certificates, allowing it to impersonate Web sites. However, running a fake Web site is not easy if you want to do it discreetly; the client's browser will see the fake certificate, and the framing may thus become apparent. For instance, the site owner may connect to his own Web site, and notice that the certificate apparently used by the server is not the one that he configured. In fact, fake server certificates are crude and suitable for fast cons, active for a few hours; they are not a good method for continuous spying, as is the NSA official job. If the NSA wants to engage in wide-scale eavesdropping on people (and I assume they want to do that; that's what their budget is for), then a much more efficient and discreet method is to add some spying hook directly in the operating system. They just have to talk to Microsoft.
The problem with self-signed certificates is that anyone can create them for any name they want. When you issue a self-signed certificate for yourself, the identity of that certificate can read whatever you want. You could create a certificate which reads "Qmal", or one which reads "Google Inc." or "Western Union". That means it provides no security whatsoever against impersonation.
That's why there are certificate authorities. The purpose of a CA is to only sign certificates when they verified that the person who provides the certificate is really who they claim to be. That way a signed certificate is prove that the owner of the website has identified itself to a 3rd party.
Sure, when CAs lose their keys or start signing certificates without verifying the identity of the owner, the system breaks. But self-signed certificates are already broken.
The idea of the CA (certificate authority) is that they are a company who is being trusted by both parties (you and the company) to operate correctly.
With self-signed certificates you do not have that independent source.
Kind of like having a notary and witness when you sign a paper document.
It's about how the trust is issued:
To trust a self-signed certificate, you need to know the certificate is legitimate through a separate channel. Maybe you created it yourself, or somebody told you the fingerprint of the self-signed certificate.
"Are certificates that are generated by these companies somehow better/different?"
They abide by a Certificate Practice Statement (CPS) which states how the certificate is issued.
This CPS and the company's reputation is used by the author of the web browser to determine if the Certificate Authority (CA) should be on their list of default trusted CAs.
"If we take to account that NSA, for example, has every private key of these issuers doesn't it make private certificates actually more secure?"
If you have control over the web browser (e.g., you're the IT department), you can remove all the browser-issued CAs and/or install your own. This way you are not relying on a third party CA to protect your data.
For covert surveillance, it's an improvement. It moves the problem up one layer. You still need to trust the web browser, the OS, the computer and the user. Additional measures are needed to protect yourself if you're concerned about this kind of surveillance.
For people who are concerned about covert Government espionage or well-connected enemies, using your own CA is a good route. Be sure to download your client web browsers and software from trusted sources over trusted links, and use measures to ensure it hasn't been tampered with.
For people who think this is quackery, legitimate organisations which have to protect themselves from covert government surveillance would be:
If you're concerned about overt government surveillance, where using escrow-free encryption is grounds for arrest, e.g., India, then you have a more complex set of problems.
Public Key Certificates exist for the purpose of binding an identity to a public key. Since anybody could claim to be anyone in a certificate, certification authorities (CAs) were introduced.
These verify the keyholder's identity and vouch for it by signing the certificate. This procedure might be repeated by higher level CAs to again vouch for the identity of lower level CAs, creating a so called chain of trust.
Your browser stores a set of trusted root certificates - lower level certificates which are chained to one of these are automatically trusted. (Note: This is how it works in X.509, which is the system used for web browsing - There exist other similar constructs, e.g. for email: see PGP)
These CAs don't sign certificates for free, which is why some web admins choose to self sign their certificates.
They thereby give up the authenticity of the connection, but may still make use of the encryption, yielding confidentiality and integrity towards the clients. This means you do still get some security, though anybody could forge an exact same certificate and impersonate the server.
This is why your browser recommends you not to use the connection. (Note: You can still get authenticity if you install the certificate as a trusted one, once you got it over a secure channel, that is e.g. face to face on a USB stick)
Now, very importantly: Looking at "properly signed" certificates, the current situation offers no security against NSA like adversaries!
This is because there exist about 1'500 trusted root CAs, and it is easy to set up an own root CA (ca $100k). With such a plethora of bodies with the right to identify anybody on the highest level, it is simply impossible to maintain trust.
For an interesting read on this with some examples from the past, see this paper from 2011. Google seems to have come up with a feasible solution though: http://www.certificate-transparency.org/
