https://en.wikipedia.org/wiki/Room_641A
Yeah, they did (and probably do).
Are you suggesting they broke TLS or that they've somehow acquired every private cert generated?