There are two different handshake modes.
Usually, the Diffie-Hellman key exchange algorithm is used to derive an ephemeral shared secret. This secret is not derived from the private key of the certificate. Instead, the server uses its private key only to sign the messages of the handshake (which include the Diffie-Hellman parameters). Based on the shared secret, client and server both calculate the Handshake Secret and then the Master Secret using HKDF. The Master Secret in turn is used to derive the actual keys for symmetric encryption of the traffic.
Alternatively, the pre-shared key (PSK) mode can be chosen, if client and server already have a shared secret, either from a previous TLS session or through some out-of-band agreement. In this case, the Master Secret can be derived directly from the PSK, or the PSK can be combined with a Diffie-Hellman key exchange to produce an ephemeral secret.
Generating the Master Secret directly from a long-term PSK should be avoided, because if the PSK is compromised, all prior TLS traffic can be decrypted. In contrast, when ephemeral keys are generated using Diffie-Hellman, an attacker who compromises the server's private key and/or the PSK still cannot decrypt past TLS traffic (so-called Forward Secrecy).
