Restrict TLS version not working

When running:
`/usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.3 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem`

SSLSCAN returns the following

> SSL/TLS Protocols:
> SSLv2 disabled
> SSLv3 disabled
> TLSv1.0 enabled
> TLSv1.1 enabled
> TLSv1.2 enabled
> TLSv1.3 enabled

While restricting the TLS version 1.2 seems to work successfully.
`/usr/local/bin/cfssl serve -ca=/opt/cfssl/cacert.pem -ca-key=/opt/cfssl/cakey.pem -config /opt/cfssl/cfssl.json -address=0.0.0.0 -port=443 -loglevel=1 -min-tls-version=1.2 -tls-key=/opt/cfssl/cfssl-ca-key.pem -tls-cert=/opt/cfssl/cfssl-ca.pem`

However the CBC ciphers are considered problematic ans we would like to force TLS 1.3 only. With both 1.2 and 1.3 enabled we see the following protocols and ciphers available.

> SSL/TLS Protocols:
> SSLv2 disabled
> SSLv3 disabled
> TLSv1.0 disabled
> TLSv1.1 disabled
> TLSv1.2 enabled
> TLSv1.3 enabled
>
> TLS Fallback SCSV:
> Server supports TLS Fallback SCSV
>
> TLS renegotiation:
> Session renegotiation not supported
>
> TLS Compression:
> OpenSSL version does not support compression
> Rebuild with zlib1g-dev package for zlib support
>
> Heartbleed:
> TLSv1.3 not vulnerable to heartbleed
> TLSv1.2 not vulnerable to heartbleed
>
> Supported Server Cipher(s):
> Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253
> Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253
> Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253
> Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253
> Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253
> Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253
> Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253
> Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253
> Accepted TLSv1.2 128 bits AES128-GCM-SHA256
> Accepted TLSv1.2 256 bits AES256-GCM-SHA384
> Accepted TLSv1.2 128 bits AES128-SHA
> Accepted TLSv1.2 256 bits AES256-SHA
> Accepted TLSv1.2 112 bits TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
> Accepted TLSv1.2 112 bits TLS_RSA_WITH_3DES_EDE_CBC_SHA