The "-cipher" switch in the tls::socket command should allow an explicit cipher
to use for a session.  It does not do this when the tls1.3 switch is set to true.

Openssl version is 1.1.1b
tcltls version 1.7.17

When the socket is set up in the following fashion it functions correctly
allowing the passed cipher to be used explicitly.

Examples of individually passed ciphers include:

DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
AES256-GCM-SHA384
AES256-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
AES128-GCM-SHA256
AES128-SHA256     ...... and so on

set server_channel [tls::socket \
   -tls1.3 0 \
   -tls1.2 1
   -tls1 0 \
   -tls1.1 0 \
   -ssl2 0 \
   -ssl3 0 \
   -server EchoAccept \
   -request 1 \
   -require 1 \
   -cafile $CA_CERTIFICATE \
   -certfile $CERTFILE \
   -keyfile $PRIVATE_KEY \
   -password get_master_password \
   -cipher $ENCRYPTION_CIPHER \
   $LISTEN_SOCKET ]

A similar setup is in place for the client.

When the tls1.3 switch is set to true, the ability to individually select the explicit cipher goes away.
In my setup, it always defaults to TLS_AES_256_GCM_SHA384.

When tls1.2 is true and tls1.3 is false is works as expected.
When tls1.3 is true, it does not function as expected (regarless of how tls1.2 is set).

Correct and corresponding setup was done on the client side when investigated.