Cirrus
Nacreous-connect option first makes TCP connection on port 443 (default) if host port is not defined. Before every TLS handhsake, TCP connection is made. So you would see CONNECTED as 443 TCP connection is open.
you can use -msg in the command and you will see immediately after CLIENT_HELLO the connection is getting reset, failing TLS handshake which proves TLS1 is disabled.
eg.
openssl s_client -connect www.example.com:443 -tls1 -msg
CONNECTED(00000004)
>>> ??? [length 0005]
16 03 01 00 79
>>> TLS 1.0, Handshake [length 0079], ClientHello
01 00 00 75 03 01 82 43 99 b4 95 de 40 94 7a 73
44 8c aa e9 92 2e 65 ad 84 a2 3d 66 1e e8 1a d7
ce ed 6b 1b 0d 67 00 00 12 c0 0a c0 14 c0 09 c0
13 00 35 00 2f 00 39 00 33 00 ff 01 00 00 3a 00
00 00 12 00 10 00 00 0d 77 77 77 2e 61 65 67 6f
6e 2e 63 6f 6d 00 0b 00 04 03 00 01 02 00 0a 00
0c 00 0a 00 1d 00 17 00 1e 00 19 00 18 00 23 00
00 00 16 00 00 00 17 00 00
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 126 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1639142869
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
---Try same command with tls1_2 option and you will successful TLS hanshake taking place along with certficate details.
You can read more in below link