One other thing that you could do, which is perhaps overkill but is useful in other scenarios, is to intercept the creation of the 48-byte TLS master secret. For many Windows applications (including IE), this happens in
lsass.exe in the following function (taken from Win7 SP1 32-bit):
You can then decrypt the captured packets after the fact in Wireshark by setting
(Pre)-Master-Secret log filename in the SSL preferences to a file file that looks like:
The session ID here can be found in the TLS headers (unencrypted) for the stream you're interested in. (Don't be fooled by the RSA -- this works for all TLS connections regardless of the ciphersuite in use.)
The advantage of this method is that, since you're not doing a man in the middle, the client application doesn't have to trust your CA, which is especially handy if you're trying to reverse some malware that actually does crypto right.
The downside is that you need to be able to debug
lsass.exe, which can be tricky; there's some information on how to do that here.