I noticed this while testing SNI-based HTTPS filtering for fun. My test was to block mail.yahoo.com, but allow other yahoo.com services. Here are my tests using Chrome:
Access mail.yahoo.com by entering the full URL https://mail.yahoo.com: BLOCKED
Access mail.yahoo.com by logging into my Yahoo account via https://yahoo.com, and clicking the "Mail" link: NOT BLOCKED
I ran a packet capture while re-creating test #2 and I see there are no Client Hello messages with the mail.yahoo.com name in the SNI extension field. This is why I assume the web filter, which relies on inspecting the SNI extension field, is not blocking the website.
I am trying to understand why I wouldn't see a Client Hello message w/ mail.yahoo.com in the SNI field when running test #2. Is the browser somehow using the same TLS session since the *.yahoo.com certificate is valid for both www.yahoo.com and mail.yahoo.com? I am interested to know more about how this works.