how to extract the hostname from a https/tls request in NEFilterSocketFlow

Hi guys, I try to create a content filter app by using network extension api. When it comes to a https/tls remote endpoint, the remoteEndpoint.hostname will always be "<private>" instead of the actual hostname. How can I extract the actual hostname?

private func filterTraffic(flow: NEFilterSocketFlow)
        -> NEFilterNewFlowVerdict
    {
        // Default action from settings will be used if no rules match
        logger.error("filter traffic...")
        guard let remoteEndpoint = flow.remoteEndpoint as? NWHostEndpoint
        else {
            logger.error("not a NWHostEndpoint)")
            return .allow()
        }
        logger.error("host name: \(remoteEndpoint.hostname)")
        if remoteEndpoint.hostname.hasSuffix("google.com"){
            logger.error("google.com")
            return .drop()
        }
        return .allow()
    }
code-block