Yeah you're at the mercy of what version of OpenSSL is used by your Nginx binaries.

I always like to play with bleeding edge latest tech so TLS 1.3 is a must for me, so I always build my Centmin Mod Nginx binaries using Nginx mainline 1.15 branch with end user selectable choice of OpenSSL 1.1.1 branch or BoringSSL crypto libraries - both allow my Nginx binaries to support TLS 1.3 https://community.centminmod.com/threads/centmin-mod-nginx-h... :)