Nginx 1.19.4 introduced a new feature called "ssl_reject_handshake" which can be used to block unwanted SSL handshakes. I noticed that, when enabled, it effectively turns off TLSv1.3. I opened the following ticket: https://trac.nginx.org/nginx/ticket/2071

It seems like the problem arises due to the way openssl handles requests, because (and I quote): "since it checks for supported protocol versions before switching context, and nginx can't influence it".

Can you confirm the findings as stated by the nginx engineer and if so, would you please consider fixing it in a future openssl release?