This used to be correct, but modern SSL clients support SNI (Server Name Indication), which involves sending the exact hostname in the clear to allow vhosts to have different certificates.  The path and everything else in the actual HTTP request is still private, though.