How are messages from server secured when using SSL certificate
You are missing the entire TLS protocol. The TLS protocol first establishes session keys. These can be randomly created at the client and send encrypted to the server. After that the session keys can be used to protect the data for confidentiality, integrity and authenticity. Encryption and authentication is performed in both directions.

The TLS protocol is however gravitating towards authenticated ephemeral Diffie-Hellman, which is a key agreement protocol. Ephemeral DH provides forward security, meaning that the session keys (and thus the data) stay secret even if the private key gets factored afterwards. In that case the private key is only used for signature generation to perform authentication.