The entire URL is encrypted, the router doesn't need to know anything about the URL to route the packets.
The only thing that can leak when you make an HTTPS connection is the DNS query.
Definitely makes sense for SPs (Service Providers) like Deutsche Telekom to pick up larger blocks - /16s even for the big ones. But MIT is more likely classified as an LIR (Local Internet Registry) - /32s are more appropriate for them.
Censored internet access though (Korean Porn-Blocker)
[ec2-user@ec2 ~]$ curl youporn.com
<html><script>
var arg = "http://warning.or.kr";
var str = new Array();
str = arg.split("&", 1);
var a = new Array();
a = str[0].split("=");
var b = Math.floor(a[1] / 100);
var c = new Array();
if(b == 10){location.replace("http://www.naver.com");}
else if(b == 20){location.replace("http://www.daum.net");}
else if(b == 30){location.replace("http://www.paran.com");}
else{ c = a[0].split("?");
location.replace(c[0]);}
</script></html>
I have seen many howtos recommending to add a monthly cronjob for the certificate renewal on the first day of the month at 12am (0 0 1 * * or @monthly). It is probably better to renew the certificate on a random day/time (30 4 5 * *) to prevent excessive load on their servers.
