what is the link between server certificate and cipher list advertised by server for nmap command?

Question

Nmap out put for google.com. ssl-enum-ciphers.

TLSv1.2:
ciphers:
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A.
TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C.
TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A.

Questions.

Server selected CIPHER for TLS1.2 is "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA.

Here key-exchange used = ECDHE. Authentication = ECDSA.

It means server using ECDHE certificate?

but server also advertises "TLS_RSA_WITH_3DES_EDE_CBC_SHA" for TLS1.2.

Key Exchange used = RSA. Authentication = RSA.

How come TLS_RSA_WITH_3DES_EDE_CBC_SHA agreed for ECDHE certificate?

Answer 1

... server also advertises

The server does not advertise any ciphers. The client advertises ciphers and the server either can choose one of the advertised or not. Detection of server supported ciphers like done in nmap just tries varies ciphers and see if it succeeds.

Here key-exchange used = ECDHE. Authentication = ECDSA.
It means server using ECDHE certificate?

There is no such thing as an ECDHE certificate. ECDHE is a key exchange which is not a property of the certificate. The relevant part here was "Authentication = ECDSA." instead, i.e. an ECC certificate where ECDSA is used as signature algorithm within authentication.

Key Exchange used = RSA. Authentication = RSA.
How come TLS_RSA_WITH_3DES_EDE_CBC_SHA agreed for ECDHE certificate?

A server can have both an ECC and RSA certificate, i.e. two different certificates for the same site on the same server. If the client supports ECDSA then the server will pick an ECDSA cipher since ECC certificates are smaller for the same security than RSA certificates. If the client only offers RSA ciphers it will get the RSA certificate.