Restrict TLS version not working

When running: /usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.3 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem

SSLSCAN returns the following

SSL/TLS Protocols: SSLv2 disabled SSLv3 disabled TLSv1.0 enabled TLSv1.1 enabled TLSv1.2 enabled TLSv1.3 enabled

While restricting the TLS version 1.2 seems to work successfully. /usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.2 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem

However the CBC ciphers are considered problematic ans we would like to force TLS 1.3 only. With both 1.2 and 1.3 enabled we see the following protocols and ciphers available.

SSL/TLS Protocols: SSLv2 disabled SSLv3 disabled TLSv1.0 disabled TLSv1.1 disabled TLSv1.2 enabled TLSv1.3 enabled

TLS Fallback SCSV: Server supports TLS Fallback SCSV

TLS renegotiation: Session renegotiation not supported

TLS Compression: OpenSSL version does not support compression Rebuild with zlib1g-dev package for zlib support

Heartbleed: TLSv1.3 not vulnerable to heartbleed TLSv1.2 not vulnerable to heartbleed

Supported Server Cipher(s): Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 Accepted TLSv1.2 128 bits AES128-GCM-SHA256
Accepted TLSv1.2 256 bits AES256-GCM-SHA384
Accepted TLSv1.2 128 bits AES128-SHA
Accepted TLSv1.2 256 bits AES256-SHA
Accepted TLSv1.2 112 bits TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA Accepted TLSv1.2 112 bits TLS_RSA_WITH_3DES_EDE_CBC_SHA