Subelement "secure:always" is supposed to work still with PHP 7.2 runtime. You may have a look at the "
app.yaml Configuration File". You mention that you think this is not working. How did you get to this conclusion? How did you test this functionality? Expected functionality is: "Requests for a URL that match this handler that do not use HTTPS are automatically redirected to the HTTPS URL with the same path. Query parameters are preserved for the redirect". What was the behavior you noticed, instead?