How to disable TLS 1.0 for Google App Engine

You’re right, the App Engine Flexible Environment is currently in Beta as stated on the official page and its implementation may change, possibly in backward-incompatible ways.

Now, in order to use Custom Domains with a Flexible Environment GAE instance, you first need to whitelist them prior adding them for your application as mentioned in this Before you Begin section. Listed in the third point, it is possible to whitelist the domains by filling out this Google contact form.

Note that prior using any custom domains, all GAE instance's traffic is served from the appspot-preview.com domain as described in the Domain Update section. Therefore, it is possible that you were initialy able to map yourdomain.com to YourProjectID.appspot-preview.com and so, presumably having your ProjectID the same as yourdomain name would explain the behavior you noticed.

You can indeed use the VPN to connect to Google App Engine Flexible Environment. App Engine Flexible Environment is based on Google Compute Engine, which makes this possible.

As described in this article, you can specify network setting in your app.yaml configuration file which will allow you to connect to your GAE Flexible application.