1.27 and tls1.2

Describe the bug

I'm trying to use tls1.2 and it doesn't work. Goes to tls1.3.

To reproduce

Steps to reproduce the behavior:

1. docker compose, build image from 'nginx:1.27'
2. use tls.12
3. only loads through 1.3

Expected behavior

page should be loaded through tls1.2 as well. If not possible then it shouldn't be loaded since tls1.3 is not available.

Your environment

• docker image nginx:1.27

Additional context

No additional configuration (worth mentioning)

    listen 443      ssl;
    listen [::]:443 ssl;
#    http2 on;
    ssl_protocols TLSv1.2;

When I do nmap (inside the container) I get:

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.3:
|     ciphers:
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp384r1) - A
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp384r1) - A
|     cipher preference: server
|_  least strength: A

Using letsencrypt, if useful.

Even though tls1.3 is not enabled in nginx config, page is loaded.

Reproduce the behavior with the nginx:1.27 Docker image and the shown listen and ssl_protocols configuration. Start by comparing the configured protocols with the nmap ssl-enum-ciphers output; done means establishing whether TLS 1.3 is enabled by the image or configuration and documenting the applicable fix or limitation.