I somehow was not able to find an answer. I can see the ciphersuits supported by the client/browser on the wire, but server does NOT appear to advertise the ciphersuites it supports during the handshake. But I know SSLLab's SSL tester does provide a report of the ciphersuites a SERVER would support. How was that done? One possibility is for the client to try ALL possibilities one at a time?