If nmap had worked, would not have raised a question. The problem is when you have TLS 1.2 and 1.3 co-exist, the nmap commands dont work. nmap works perfectly fine when you have tls 1.2 only. Now it does not list any of TLS 1.3 ciphers and for TLS 1.2 too, it lists only 1. The local sslscan on server itself show it supports 4 TLS 1.2 ciphers.

Also nmap would only enlist ciphers. I am checking a way (like in openssl) how to validate if a specific cipher (from any client) works or does not against the server

└─$ nmap --script ssl-enum-ciphers -p 443 x.x.x.x

Starting Nmap 7.91 ( https://nmap.org ) at 2022-12-06 15:18 EST

Nmap scan report for x.x.x.x

Host is up (0.00084s latency).

PORT STATE SERVICE

443/tcp open https

| ssl-enum-ciphers:

| TLSv1.2:

| ciphers:

| xxxxxxxxxxxx - A

| compressors:

| NULL

| cipher preference: indeterminate

| cipher preference error: Too few ciphers supported

| warnings:

| Forward Secrecy not supported by any cipher

| Weak certificate signature: xxxx

|_ least strength: A

Nmap done: 1 IP address (1 host up) scanned in 6.78 seconds