The following URLs are required as SSL exceptions. Please be aware that accounts.google.com will allow the user to sign in to their Google Account, however, so long as Google Safe Search is being enforced via DNS, this should not allow the user's account preferences for no-safesearch to take effect. Please test following deployment of rules to confirm:
XG Rules
^([A-Za-z0-9.-]*\.)?gstatic.com\.com/
^([A-Za-z0-9.-]*\.)?google-analytics\.com/
^([A-Za-z0-9.-]*\.)s\.ytimg\.com/
^([A-Za-z0-9.-]*\.)?googleapis\.com/
([A-Za-z0-9.-]*\.)?googleusercontent\.com/
^([A-Za-z0-9.-]*\.)?googledrive\.com/
([A-Za-z0-9.-]*\.)?accounts\.google\.com/
^([A-Za-z0-9.-]*\.)?drive\.google\.com/