Custom domain on an App
An App can serve your own domain, apex or www, through every deploy and rollback. Its HTTPS certificate is issued and checked before you point the name at the App, so the first visitor already gets HTTPS, and it renews by itself at least 30 days before it expires. See networking.