What changed
Google Cloud says App Engine is automatically opting applications into TLS 1.2 and later during August 2026. Applications that still require TLS 1.1 or earlier can opt out only until the end of August. Starting in September, App Engine might permanently block insecure traffic using TLS 1.1 and earlier.
Why it matters
Old clients, embedded devices, legacy integrations and outdated TLS libraries may lose access even when the application itself is healthy. Because enforcement differs between appspot.com and custom domains, operators need protocol-level testing rather than relying only on HTTP status monitoring.
The opt-out window closes at the end of August
App Engine's current minimum-TLS guidance says existing applications are being opted into TLS 1.2+ during August. Operators who still need legacy support have only the remainder of the month to use the temporary opt-out or contact Support.
September blocking differs by hostname type
Google says appspot.com traffic can be blocked at the connection level, while custom-domain connections might complete the TLS handshake but have the request blocked. That distinction affects how failures appear in logs, synthetic tests and client telemetry.
Test clients, not just servers
The risk sits with callers that negotiate TLS 1.1 or earlier. Teams should identify old SDKs, Java runtimes, embedded systems and third-party integrations and run real handshakes against production-equivalent endpoints.