Secure your app with minimum TLS (flexible environment)

To increase security, starting in August 2026, App Engine automatically opts your application into TLS version 1.2 and later, with supported cipher suites by default. If your application requires legacy TLS version 1.1 and earlier, you can opt out using the Google Cloud console or the Google Cloud CLI until the end of August 2026.

Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For appspot.com domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked.

If your application requires additional time to support older TLS versions, contact Support.

For new applications, App Engine only allows secure traffic with TLS version 1.2 and later, with supported cipher suites, by default. If your application only requires TLS version 1.2 and later with the default supported cipher suites, you don't need to configure a global external Application Load Balancer to route requests. However, if you need to support a different set of cipher suites, or require connection-level (handshake) rejection of insecure TLS versions for custom domains, configure a global external Application Load Balancer.

Note: If you update your application settings to enforce TLS version 1.2 and later, App Engine automatically rejects incoming requests that attempt to use older, less secure TLS versions 1.1 and earlier. Before September 2026, this rejection causes a 400 Bad Request - The request was malformed error, after a successful TLS handshake, meaning the connection is established, but the request itself is denied. External SSL-checking sites might only verify a successful TLS handshake, and incorrectly imply that TLS version 1.1 and earlier are still supported. After September 2026, App Engine ensures stricter security compliance by preventing the TLS handshake itself for connections using TLS version 1.1 and earlier.

Supported TLS versions and cipher suites

The security of TLS connections depends on the negotiated cipher suite, a combination of cryptographic algorithms. These cipher suites are identified by IANA values, as detailed in the following table:

TLS version	IANA value	Cipher suite
TLS v1.3	0x1301	TLS_AES_128_GCM_SHA256
	0x1302	TLS_AES_256_GCM_SHA384
	0x1303	TLS_CHACHA20_POLY1305_SHA256
TLS v1.2	0xCCA9	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
	0xCCA8	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
	0xC02B	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
	0xC02F	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	0xC02C	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
	0xC030	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	0xC009	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
	0xC013	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
	0xC00A	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
	0xC014	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

If you need to use a different or a less restrictive cipher suite, we recommend that you use a global external Application Load Balancer. For more information, see Set up a classic Application Load Balancer with App Engine and SSL policies for SSL and TLS protocols in the Cloud Load Balancing documentation.

Update the TLS versions allowed for your app

You can update the TLS version using the Google Cloud console or the gcloud CLI. For tool-specific steps, click the tab for your preferred tool:

Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For projects where older TLS versions have been permanently blocked, this opt-in setting isn't available. If your project requires older TLS versions, contact Support.

Console

1. In the Google Cloud console, go to the App Engine Settings page:

   Go to Settings

2. In the Application settings tab, click Edit application settings.

3. From the SSL Policy list, select one of the following:

   • TLS 1.2+ (Modern ciphers) (Default): Only allows TLS version 1.2 and later, with modern cipher suites.
   • TLS 1.0+ (Obsolete): Allows insecure traffic with TLS version 1.1 and earlier.

4. Click Save.

gcloud

When you create or update your application, use the --ssl-policy flag to specify the minimum permitted TLS version.

To set a minimum TLS version while creating your app:

gcloud app create --ssl-policy=TLS_VERSION

To set a minimum TLS version while updating your app:

gcloud app update --ssl-policy=TLS_VERSION

Replace TLS_VERSION with TLS_VERSION_1_2. This only allows TLS version 1.2 and later, with modern cipher suites. If you want to allow less secure TLS version, such as, 1.1 and earlier, replace TLS_VERSION with TLS_VERSION_1_0. However, we recommend that you update your applications to use the latest supported TLS version.

Disable custom TLS versions and ciphers

If you use Cloud Load Balancing and serverless NEGS to route traffic to your App Engine application, you can further restrict TLS versions or ciphers by defining an SSL security policy on your load balancer.

What's next

• To verify and manage SSL certificates, see Secure custom domains with SSL.

• To enable Cloud Load Balancing to manage incoming requests to your custom domain, see Migrate App Engine custom domain to Cloud Load Balancing.