Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires to attack the TLS/SSL traffic. Specifically, if I assume my CA to leak the private key it issued me to a third party Mallory (Mallory might also be identical to CA), can passive eavesdropping of TCP packets enable Mallory to get the plaintext? Or does Mallory need Man-In-The-Middle capabilities to read the plaintext?
My rationale for this is as follows: if the certifiacte merely enables a verified Diffie-Hellman, you have to interfere with the key exchange to be able to fool server and client into using your own key(s). But does X.509 do so?