What makes SSL certificate companies not to sell our private key?
SSL certificate companies (also know as certificate authorities, or CA's) do not have your private key. The certificate signing request (CSR) that you send to a CA contains your public key, and a digital signature that proves that you are in possession of the private key corresponding to that public key. But, it does not contain the private key.
I created my own SSL but browsers don't accept it as a valid certificate and we are enforced to use a third party certificate.
That's a good thing. If your browser accepted just any certificate, then what would stop an attacker from creating a certificate for your site, and MITM'ing your site?
With regard to openssl, are you confusing openssl (a program which is used to implement SSL/TLS) with a CA?
With regard to the overall sentiment of your question: Yes, we put our trust in CA's. Most of the time, CA's do what we expect, but there have been instances where they've failed. See If an adversary took over a major Certificate Authority, what bad things could they do? for some interesting reading on this subject. Also, see https://moxie.org/2011/04/11/ssl-and-the-future-of-authenticity.html for some ideas by cryptographer Moxie Marlinspike on how we might be able to rely less on CA's.