tshark as mentioned in the question should work fine. However, it will require two pass analysis (which was not used in the provided link), and the filters will need to be updated a bit for more modern wireshark versions.
$ tshark -2 -r tor_traffic.pcap -T fields -R "ssl.handshake.certificate" -e x509af.utcTime -e x509sat.printableString
15-01-23 00:00:00 (UTC),15-09-16 23:59:59 (UTC) www.mo7pofg5qx4qezly.com,www.imhw73oq35uluhcjz.net
15-02-12 00:00:00 (UTC),15-04-21 23:59:59 (UTC)
14-12-01 00:00:00 (UTC),15-05-03 00:00:00 (UTC) www.pghq2hykgwzwkgzghrn.com,www.b62klkcmc7zmt3s.net
tor_traffic.pcap has been pre-captured with your favorite tool (Wireshark, tcpdump, etc.). You'll also want to make sure the packet capture is run on whatever interface the VM is using.