You can block youtube with or without SSL Decryption.
With SSL Decryption, and if you don't want to implement it for *everything* you can do a targeted decryption to *.google.com and then block youtube.com and *.youtube.com with a Custom URL Category, or simply add those lines to the URL Filtering Profile Block List. I explain how to do a targeted decryption on document: How to Block a Specific HTTPS Site with URL Filtering
Without SSL decryption we can't see the HTTP GET, so URL Filtering wouldn't ever trigger. However, without SSL decryption we can still see the SNI (sent from the Browser) and the CN (inside Subject Name field, in the certificate presented by the server). The CN for youtube is *.google.com, however blocking this will also block all HTTPS sites with certificates that present *.google.com
Note that in order to present a block page without SSL decryption, you may want to refer to How to Serve a URL Response Page Over an HTTPS Session Without SSL Decryption
The SNI is sent from the browser on the SSL 'Client Hello' message, and it is, in this example: www.youtube.com
This means that adding an URL Filtering Block rule for *.youtube.com, will block access to YouTube by leveraging the SNI.
This (reading SNI) is a feature which was included on PAN-OS 6.0
Please note that not all browsers do support SNI (not all of them send the SNI value).
Note that the SNI is an extension of TLS (a.k.a SSLv3.1 and above), so SSLv3.0 won't send the SNI, even if you are using the correct browser. Please disable SSLv3.0 in your browser to make sure it's not contributing to the problem. Digicert has an excellent tutorial on how to achieve this. See: Disabling Browser Support - SSL v3 Protocol | DigiCert.com
To know when SNI was implemented into a Browser/Operative System combination, there's a good article on it on Wikipedia. See: Server Name Indication - Wikipedia, the free encyclopedia
Implementation[edit]
In 2004, a patch for adding TLS/SNI into OpenSSL was created by the EdelKey project. [5] In 2006, this patch was then ported to the development branch of OpenSSL, and in 2007 it was back-ported to OpenSSL 0.9.8.
For an application program to implement SNI, the TLS library it uses must implement it and the application must pass the hostname to the TLS library. Further complicating matters, the TLS library may either be included in the application program or be a component of the underlying operating system. Because of this, some browsers implement SNI when running on any operating system, while others implement it only when running on certain operating systems.
Web browsers [6] [edit]
Internet Explorer 7 or later, on Windows Vista or higher. Not in any Internet Explorer version on Windows XP or Windows Server 2003 because SNI depends upon the SChannel system component shipped with Windows Vista. [7]
Mozilla Firefox 2.0 or later
Opera 8.0 (2005) or later (the TLS 1.1 protocol must be enabled) [8]
Opera Mobile at least version 10.1 beta on Android [citation needed]
Google Chrome (Vista or higher. XP on Chrome 6 or newer. [9] OS X 10.5.7 or higher on Chrome 5.0.342.1 or newer)
Safari 3.0 or later (Mac OS X 10.5.6 or higher and Windows Vista or higher)
Konqueror/KDE 4.7 or later [10]
MobileSafari in Apple iOS 4.0 or later [11]
Android default browser on Honeycomb (v3.x) or newer [12]
BlackBerry 10 and BlackBerry Tablet OS default browser
Windows Phone 7 or later [13]
MicroB on Maemo
Odyssey on MorphOS
... View more
