Reading a handshake trace
The client hello carries the name of the site and the key shares; the server answers with its share, then everything after that is encrypted. The certificate travels inside the encrypted part, which is why a passive observer sees the name but not the certificate.
Session tickets arrive after the handshake has finished. They are small, but their size depends on the server software, so two servers configured differently can be told apart by them alone.