Regarding problem TLS-session-close itself -- There is No any errors nor in error-log nor in access-log.
I'm going to try the 1.22....
"Our" NGINX-1.21 has been build from sources with OpenSSL-3.0 -- because we need KTLS introduced in OpenSSL-3.0.

Q: Does the 1.22 already built with OpenSSL-3.0 -- e.g. "ready for apt-install"
or I need to take sources and rebuild like previously?