Once a connection between the server and browser is established, and a public key encoded in the certificate is sent from the server to the browser, the browser needs to generate a symmetric key for encryption of the data that will be transmitted further. Here, browser and the server both will compare their lists of available encryption algorithms(Cipher Suits) and choose the strongest one they both support for symmetric encryption. Nowadays modern Browsers and Servers usually use three algorithms for this:
- RC4(128bit)
- AES(128bit)i
- AES(256bit)
For IIS webserver, you can force your webserver to use only 256-bit encryption. In case of Unix based servers, available ciphers usually depend on an openssl library. Hence, if your website is hosted on a server whose webserver supports 256-bit encryption such as Apache 2.X, then site visitors that use a Firefox browser will have their transactions with your site protected by 256-encryption. Thus with the right combination of Web browser and Web server, you can establish a 256-bit encrypted secure connection.
How would Browser know whether to generate a 256 Bit key or 128 Bit?
For any secure website, click on padlock sign, if you see cipher suite AES_128_GCM ECDHE_ECDSA under Connection tab.

That means, both server and browser have negotiated to use cipher suite AES_128_GCM. They will use 128 Bit Encryption with ECDHA_ECDSA key exchange.