I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you do a nslookup on them and then search the IP address in chrome it varies what happens. When you nslookup google I get 172.217.7.174 and when you enter that it redirects to google.com as expected. But when you do the same for yahoo.com it takes you to an empty page. When you do it for Microsoft.com 23.100.122.175 it takes you to a "your connection is not private" page and then from there, you can see the information for Microsofts wildcard cert when you click NET::ERR_CERT_COMMON_NAME_INVALID.
So my questions are:
Isn't the private key for a cert supposed to be kept a secret? Is it okay to have your website like microsoft's that displays the cert in its entirety? If someone gets your cert cant they spoof your websites? Shouldn't you be implementing some sort of redirect for IP addresses like a 301 or something?