To complete what @Lucas said, when you connect to
https://www.facebook.com/, the name
www.facebook.com will be made visible to your ISP in several ways:
- Your machine will first ask for DNS resolution of
www.facebook.com; the request will usually be sent to your ISP's DNS servers, and would in any case travel unprotected from its eyes.
ClientHello message that your browser sends to initiate the SSL/TLS handshake will contain the name
www.facebook.com in plain letters (that's the Server Name Indication extension, implemented by all recent OS and browsers).
- During the handshake, the server will send its certificate, still as cleartext, and the certificate contains the server's name, or close enough (in the specific case of
www.facebook.com, it contains
*.facebook.com). This is expected, since the client (your browser) mandates it that way, in application of RFC 2818.
All the SSL handshake is made first, and then, only then, does HTTP itself begins. Thus, the HTTP request, which contains the target path ("/FOOBAR") will be protected by the encryption provided by the SSL tunnel. Note that encryption protects the data but not the length: your ISP could probably work out that your target path consists of seven characters (it would require observing a few other requests from your browser, and some "educated guessing", because the whole HTTP request is encrypted, so the ISP would have to estimate the total length of the other HTTP headers).