http://core.trac.wordpress.org/ticket/18719 has a working patch now.

http://core.trac.wordpress.org/ticket/18719 has a working patch now.

Edit: Plugin code to do similar until patch gets in:

wp_oembed_add_provider('#https://(www\.)?youtube.com/watch.*#i', 'http://youtube.com/oembed?scheme=https', true);
wp_oembed_add_provider('https://youtu.be/*', 'http://youtube.com/oembed?scheme=https', false );

In theory, simply changing these lines:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

to these:

'#https?://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'https?://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

in the class-oembed.php file will do the trick. However, the resulting iframe won't be SSL.

In a perfect world, this would do the job:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),
'#https://(www\.)?youtube.com/watch.*#i'         => array( 'https://www.youtube.com/oembed',            true  ),
'https://youtu.be/*'                             => array( 'https://www.youtube.com/oembed',            false ),

But there are two problems:

1. The wp_remote_get in the _fetch_with_format function doesn't disable the sslverify option. So unless you have fully updated Certificate Authority lists in your PHP install (which no realistic PHP install has), then the SSL GET call will fail.

2. YouTube still doesn't return https src's in the iframes even when you use SSL throughout the request. So the resulting iframe will be http, potentially breaking the "secure" page in some browsers, if the page this is being embedded on is https as well.

The patch in WordPress code to support SSL (and ignore sslverify for oembed calls) is easy, however it's pointless until YouTube returns HTTPS src's in their oembed results.

http://core.trac.wordpress.org/ticket/18719 has a working patch now.