Restrict TLS version not working

[scah2021]

When running:
/usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.3 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem

SSLSCAN returns the following

SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 enabled
TLSv1.1 enabled
TLSv1.2 enabled
TLSv1.3 enabled

While restricting the TLS version 1.2 seems to work successfully.
/usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.2 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem

However the CBC ciphers are considered problematic ans we would like to force TLS 1.3 only. With both 1.2 and 1.3 enabled we see the following protocols and ciphers available.

SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 disabled
TLSv1.1 disabled
TLSv1.2 enabled
TLSv1.3 enabled

TLS Fallback SCSV:
Server supports TLS Fallback SCSV

TLS renegotiation:
Session renegotiation not supported

TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

Heartbleed:
TLSv1.3 not vulnerable to heartbleed
TLSv1.2 not vulnerable to heartbleed

Supported Server Cipher(s):
Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253
Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253
Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253
Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253
Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253
Accepted TLSv1.2 128 bits AES128-GCM-SHA256
Accepted TLSv1.2 256 bits AES256-GCM-SHA384
Accepted TLSv1.2 128 bits AES128-SHA
Accepted TLSv1.2 256 bits AES256-SHA
Accepted TLSv1.2 112 bits TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
Accepted TLSv1.2 112 bits TLS_RSA_WITH_3DES_EDE_CBC_SHA