This is because "notlsv1" used to disable TLSv1.0 only and had no effect on v1.1/v1.2. so better have an option for each version. This applies both to "bind" and "server" statements.