So I've configured my stunnel to only use TLS1.2  and usually works ok. However when client gets some bad L7 response it send a TCP RST, after which all subsequent stunnel TLS Client Hellos are some hybrid of TLS1.0/TLS1.2, as can be seen in tshark output below. Once I restart the whole stunnel process subsequent TLS handshakes work fine using TLS1.2, until the next client RST is received.

$ stunnel -version
stunnel 4.56 on x86_64-redhat-linux-gnu platform

$ cat /etc/centos-release
CentOS Linux release 7.8.2003 (Core)

$cat /etc/stunnel/dsr2rtcg-stunnel.conf
output = /var/log/stunnel
pid = /etc/stunnel/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

[poc]
cert = /etc/pki/tls/certs/stunnel/aaa.crt
key = /etc/pki/tls/private/stunnel/aaa.key
CAfile = /etc/pki/tls/certs/stunnel/bbb.crt
client = yes
sslVersion = TLSv1.2
options = NO_TLSv1
accept = 172.18.180.78:45154
connect = 10.74.0.196:45154
ciphers = TLSv1.2+HIGH:!aNULL

$ tshark -nn -V -d tcp.port==45154,ssl -r 20200729_09:42:44-port45154.pcap -2R "ssl.handshake" -c 1 | grep -i tls -B3
Secure Sockets Layer
    SSL Record Layer: Handshake Protocol: Client Hello
        Content Type: Handshake (22)
        Version: TLS 1.0 (0x0301)
--
        Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 1610
            Version: TLS 1.2 (0x0303)