If certificate authority generates key pair for us, do they maintain/have access to our private key?

Question

If they do keep our private key and by chance if anyone within the CA organization listen to our conversation. Isn't it a confidentiality breakage?

Answer 1

This is a bad model. The proper way to request a certificate is to send a CSR (certificate signing request) to the certificate authority

The CSR contains your public key only (it is signed using your private key to prove that you own the private key, and to ensure integrity of the request contents).

You should not use a mechanism where the CA generates the private key for you, it is not needed and only adds more ways for your private key to leak.

Final note: as usual, context matters a lot: if the scenario involves certificate issuance within an organization (eg: internal CA for corporate infrastructure) it might be acceptable, especially if the organization has a good process in place for key management. If possible show the source of the slide, it might make more sense in context.

Answer 2

Isn't it a confidentiality breakage?

It depends how you define confidentiality. If you mean that nobody except the private key owner is authorized to know the private key, than yes it is a confidentiality breakage. But in some organizations there can be a policy that allows also some other persons (e.g. system administrators) to know user passwords or to have a copy of their private key. Means such persons are authorized to know this information. Thus this would not be a breakage. Breakage is the case when persons are unauthorized.

The picture in your question contains a misleading text "Example (Good)". In some cases like described above it can be fine. But in others, e.g. if user needs a certificate for private goals, such scheme is not good, but disastrous.