Recently, I found out, it is entirely possible to define custom ciphers; take this example:
## Select which SSL ciphers `vsftpd` will allow for encrypted SSL connections (required by FileZilla).
Further, not that the OP had asked, but I feel I could share another security possibility.
That being enabling only TLSv1.2 and TLSv1.3. This can be achieved with:
## The following might look strange as
## it does not seem to allow any protocol;
## But it does allow TLSv1.2 + TLSv1.3.
# disallow SSLv2 protocol
# disallow SSLv3 protocol
# disallow TLSv1.0+TLSv1.1 protocols
In the end, I recommend testing your config for instance on ImmuniWeb, where you could easily debug your configuration.
This is just a sample: