docker client 19.03.1 starts tls handshake with TLSv1 client hello message

Description
docker login would produce the following error:
Error response from daemon: Get https://some.registry.com/v2/: EOF

tcpdump showed that the client side sent TLSv1 "client hello" message and the TLS session is not established (TLSv1 is the "protocal" column as displayed in Wireshark). The server side goes through a A10 load balancer which offers only TLSv1.2 ciphers but otherwise is not upto latest security patches.

Only the newer docker versions get this issue, e.g., 19.03, 18.09. But 18.03 would send TLSv1.2 client hello to the same server and docker login would succeed (TLSv1.2 is the "protocol" column in Wireshark). The newer docker versions are supposed to remove support for TLS < v1.2 thus should never claim it supports TLSv1. Actually I believe that TLS client hello TLSv1 means only TLSv1 is supported, opposite of the reality.

Upon further examination, the client hello packet contents seem identical other than the Random and Session ID. Thus seems Wiresshark adding to the confusion rather than indication of the issue. The eventual failure seems caused by lacking a common cipher in the suites used by the client and server.

Thus the docker client/daemon's responsibility in this could be a more informative error message, e.g., TLS handshake failure: no common cipher.

Steps to reproduce the issue:
Other than the description above, we do not know what prompted the client side (the daemon) to send the TLSv1 client hello.

Describe the results you received:
See description.

Describe the results you expected:
See description.

Additional information you deem important (e.g. issue happens only occasionally):

Output of docker version:
docker window desktop installation, latest version. docker linux 18.09 and 18.03 also tested.

(paste your output here)

Output of docker info:

(paste your output here)

Additional environment details (AWS, VirtualBox, physical, etc.):

Start by reproducing docker login against a registry behind the described A10 load balancer and capture the TLS handshake and resulting error. Compare the behavior of Docker 18.03, 18.09, and 19.03; the issue is done when the failure is understood and the client or daemon reports a more informative TLS handshake error, if that is the confirmed cause.