Given that Site X uses HTTPS, how can it be blocked by a country?

My browser reads: 128-bit encryption | ECDHE_RSA as key exchange.

I say it's blocked since when I use Tor, it works fine.

One important thing to point out is that it's not blocked in the typical sense we are used to see, which clearly shows a page that says it's blocked, instead, site X is blocked in a way that my browser just doesn't load the page and displays the error: 


  This webpage is not available, Error code: ERR_CONNECTION_RESET 


for the HTTPS version, and that regular "page is blocked" page when requesting the HTTP version.

Note that no other HTTPS sites are blocked! Just this one! I assume this is evidence that excludes port blocking and protocol blocking. However, it leaves DPI; but there are other HTTP-blocked websites which have the HTTPS version still working! If they can DPI-block site X, why can't they block the other HTTPS sites the same way?

TL;DR: TLS only secures the content of a message. Not the metadata.

When communicating over the clear net, it's important to remember that there are some portions of a given communication that cannot be secured using standard technologies. Unless you use something like TOR, your ISP will be able to determine who you're talking to even if you're using TLS.

To use an analogy, imagine sending an envelope via the postal service. The contents of the envelope are completely inaccessible to anyone other than the recipient. Even if a postman were to somehow view the contents, they wouldn't be able to comprehend it (Perhaps you ran it through a Caesar cipher first? Hehe). 

However, in order to have the postal service send it to the correct address, the outside of the envelope must be marked with a plainly readable representation of the destination address. If the postal service didn't want anyone to be able to send letters to "Joe Schmoe, 123 Fake street," then they could just not deliver any letters with that address.

Since the postal service can't read the contents of the message, they have no way to identify the intent of the letter. The only information that they have is the fact that the intended recipient is Joe Schmoe. They can't screen only the letters that they deem to be malicious; it's all or nothing.

Similarly, the IP protocol (the routing protocol that TCP runs on top of) has plainly marked "sender" and "receiver" fields. TLS cannot encrypt this for two reasons:


TLS runs on top of TCP/IP, and thus cannot modify parts of the packets that belong to those protocols.
If the IP section was encrypted, then the carrier service (ISP routers) would not be able to identify where the packets need to go to. 


The firewall that your ISP or country is forcing all of your traffic through cannot inspect TLS traffic. They only know the metadata supplied by the TCP/IP protocol. They have also deemed that the site you want to access is more bad than good, so they drop all of the traffic to and from the site regardless of the contents.

There is a method to secure even the metadata of online communications, but it is slow and not very scalable. TOR hidden services are one attempt at implementing this. Of course, hidden services only work within the TOR network, which can only be accessed by first connecting to a machine over the clear net. This means that the ISP or firewall still knows that you're proxying your data through the onion. No matter how you try, you will always leak some metadata. If they wanted to, they could reset all connections to TOR nodes in addition to the site they're currently blocking.

If you are trying to establish a direct connection to a specific IP through a firewall, and the firewall has explicit rules to kill any traffic to or from that given IP, then connecting to that IP directly will always be fruitless. You will have to connect to it indirectly, either through TOR, a VPN, or some other proxy service.
