The private keys for an SSL/TLS digital certificate for *.xboxlive.com were "inadvertently disclosed," Microsoft says.