I'm not sure if this belongs here or in stack overflow. I have set up a custom domain website using a PHP Google Cloud App engine. After some third party security testing i've been advised to disable the use of cipher suite DES-CBC3-SHA (TLS_RSA_WITH_3DES_EDE_CBC_SHA).

I'm trying to find out if its possible to disable this for a Google PHP App engine? Most of what I can find online either doesn't answer this particular question or is somewhat out of date.

I found this post useful, https://stackoverflow.com/questions/42681247/can-google-app-engine-java-support-tls1-0 . This suggests it's not possible, however it doesn't actually answer the question, it just concludes that if its good enough for google it should be fine.

2 Answers 2


I found out that, if the App Engine uses a custom domain, it is possible to disable it for the custom domain. To do this you have to contact GCP and make a request with them. The whole process took them about 3 weeks to disable it.


App Engine performs TLS termination before handing off the request to your application, and the front ends are shared by multiple applications. (Essentially these are load balancers.) Consequently, individual applications are unable to change TLS settings or disable ciphers, as there's no group of load balancers dedicated to your app.

  • 1
    Is it still true as of June 2019 that App Engine with a custom domain still requires you to make a request with them? Our App Engine app just failed a security scan due to accepting weak forms of TLS. Jun 24, 2019 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .