Lee Brotherston spoke at DerbyCon 2015 on Stealthier Attacks and Smarter Defending with TLS Fingerprinting -- slides -- video.
He also released code to go along with the talk -- https://github.com/LeeBrotherston/tls-fingerprinting/tree/master/fingerprintls
The below is taken from his website -- http://blog.squarelemon.com/tls-fingerprinting/
Transport Layer Security (TLS) provides security in the form of
encryption to all manner of network connections from legitimate
financial transactions, to private conversations, and malware calling
home. The inability for an eavesdropper to analyze this encrypted
traffic protects its users, whether they are legitimate or malicious.
Those using TLS operate under the assumption that although an
eavesdropper can easily observe the existence of their session, its
source and destination IP addresses, that the content itself is secure
and unreadable without access to cryptographic keying material at one
or both ends of the connection. On the surface this holds true,
barring any configuration flaws or exploitable vulnerabilities.
However, using TLS Fingerprinting, it is easy to quickly and passively
determine which client is being used, and then to apply this
information from both the attacker and the defender perspectives.
FingerprinTLS is designed to rapidly identify known TLS
connections and to fingerprint unknown TLS connections. Input is taken
either via live network sniffing or reading a PCAP file. Output for
recognized connections is (currently) in human readable form and for
unknown fingerprints in the JSON format used for the fingerprint
Fingerprints which are generated can be exported as a C
struct by Fingerprintout and compiled back into FingerprinTLS to
enable detecting in future instances.
Lee demonstrates how easy it is to fingerprint clients by the TLS signatures in a later talk he did at SecTor CA -- http://www.slideshare.net/LeeBrotherston/tls-fingerprinting-sectorca-edition -- be sure to check out slides 66 and 69-70.
fingerprintls -i en0 -s
He also shows how to import new signatures here -- https://gist.github.com/LeeBrotherston/1a0ae1aedd968af1fce3
Another demonstration shows how to leverage the Berkeley Packet Filter (BPF) from other tools and frameworks such as Wireshark, tcpdump, and/or libpcap -- https://gist.github.com/LeeBrotherston/92cc2637f33468485b8f
Finally, Lee analyses a sample pcap from the Pokemon Go video game off an Android device -- https://gist.github.com/LeeBrotherston/5cca4b372277d7c6a049b26f87544351
Certainly older methods described by some of the other answers here may still be relevant, but I do suggest you check out the work above. For more on the work that SSLLabs did, check out -- https://github.com/ssllabs/sslhaf -- which is an Apache module for passive SSL client fingerprinting