elastic/elasticsearch#35838 adds, initially optional, support to include the CNAME in the return payload of http.publish_address, which this plugin should support.
eg - currently the value of publish_address returned from /_nodes/http will currently return something like
"publish_address" : "127.0.0.1:9200"
in the payload, but the referenced commit will add the ability to change this to
"publish_address" : "elastic.co/127.0.0.1:9200"
Historically, there have been issues with using TLS together with sniffing when server certificates only contain the fully qualified domain names, not the server ip addresses, due to the return value of http.publish_addresses from Elasticsearch only returning the ip address