Firstly, often encryption is terminated at the perimeter by infrastructure which is dedicated to offloading SSL decryption. It makes it much easier to manage when you only have maintain a high degree of key security for a small (proportionally) group of servers which are dedicated to the role. The rest of your regular application servers can operate like normal without worrying about handling these keys. Secondly, their keys would almost certainly be stored via a <a href="http://en.wikipedia.org/wiki/Hardware_security_module">Hardware Security Module</a> (HSM). These are dedicated hardware with a processor designed for maintaining security and being efficient at performing cryptography. Finally, <a href="https://pki.google.com/">Google has its own intermediate CA certificate</a> which it can use to sign its own leaf certificates. This allows them to use certificates with a far shorter expiry than normal, which somewhat reduces the risk of a key being compromised. For example here's a print screen of a current Google certificate: ![enter image description here][1] You'll notice that the certificate is only valid for 3 months, which is significantly shorter than most. [1]: https://i.sstatic.net/NZJ6B.png