This question already has an answer here:
- How much information can my ISP see? 5 answers
If I am visiting a
https url say
https://www.youtube.com/watch?v=7HKoqNJtMTQ. What exactly my ISP will see ?
You can always install Wireshark and see what's going out of your Internet-facing network interface for yourself.
This Stack Overflow post gives you specific details. The destination host you are connecting to will be known, as it's part of the certificate involved in the SSL setup. That's the "www.youtube.com" part of the URL. The rest of the specific URL isn't visible to your ISP, but if you are using your ISP's DNS servers, your ISP will be able to know you at least made a DNS lookup to that site. A DNS lookup cannot be tracked back to a specific URL but keep in mind some sites put different types of content on different servers (such as Bing putting all explicit content on its own domain) and that could implicate you. Use a non-ISP DNS such as OpenDNS if you can.
This is assuming you've verified that the certificate presented by the server is the one you are expecting. SSL proxies (i.e. "man-in-the-middle") are possible but they will substitute a different certificate - which is on you to check for, especially if the substituted certificate is part of the plethora of "trusted root certificates" recognized by most browsers.
If the ssl certificate of the destination site is compromised, e.g. by a wildcard certificate owned by a 3rd party, the confidentiality can be compromised on the way to the destination side. (e.g. see this article)
company use case
If your ISP is your company, all your traffic may become visible for the company.
Think about a setup, there an additional root certificate owned by the company is deployed to the browser key store. Using this certificate the attack described is easily possible.
In this case a ssl enabled reverse proxy like squid can be used to crack up your encrypted connection.
All URLs go out over and open connection, so your ISP can see what sites you're visiting and the page you're accessing. If the URL happens to specify HTTPS, then the response is encrypted, so they can't grab the contents of the page being downloaded. If the page includes an embedded stream, that's a separate HTTP request, and what I just said applies to that interaction separately.
If you're unhappy with your ISP knowing which URLs you access, consider using VPN — though in that case, you're assuming that the VPN provider has more respect for your privacy than the ISP.