In a Wireshark capture, when connecting to an HTTPS web server that is configured to present a certificate, there should be a "Certificate, Server Key Exchange, Server Hello Done" event in the capture. For example, my website here, https://www.freekb.net is configured with an SSL certificate.

Then I start a Wireshark capture, I reload https://www.freekb.net, and I can see the "Certificate, Server Key Exchange, Server Hello Done" event in the capture, showing that certificate that was used.