You need to look at the TLS handshake record that sends the server certificate. Use the display filter tls.handshake.type == 11 to find certificate records.