Custom domain stuck at VALIDATING_OWNERSHIP despite correct & propagated CNAME (suspected Let's Encrypt rate limit)
tettyshirao-whitail
HOBBYOP
22 days ago
Hi Railway team,
A custom domain on my service is stuck issuing its TLS certificate
and I'd
appreciate a manual re-trigger or guidance.
Details
- Project: whitail-lms (id: 09759d6e-bd0e-4743-a04c-90dc1ea46f7c)
- Service: whitail-lms-web (id:
2963fde1-dd97-4d3e-a55e-8f6aa904b73b)
- Environment: production
- Custom domain: lms.whitail.co.jp
- Required CNAME target: jxomlsm1.up.railway.app
Current state
- The CNAME is correct, DNS-only (unproxied through Cloudflare),
and fully
propagated. Railway's own dashboard reports the DNS record asPROPAGATED
with a matching currentValue (jxomlsm1.up.railway.app).- Despite this, certificateStatus has remained
VALIDATING_OWNERSHIP for over
18 minutes after the correct DNS was detected, and the cert isnever issued.
Visiting https://lms.whitail.co.jp returns an SSL error (novalid cert).
What I already tried
- Verified the CNAME from multiple public resolvers (1.1.1.1,
8.8.8.8) — all
return jxomlsm1.up.railway.app.- Confirmed Cloudflare Proxy is OFF (DNS-only), so validation
isn't blocked.
- I deleted and recreated the custom domain a few times earlier
while fixing
the CNAME, so I suspect this hostname hit a Let's Encrypt ratelimit.
Request
- Could you manually re-trigger / force re-issuance of the
certificate for
lms.whitail.co.jp?2. If it's a Let's Encrypt rate limit, please let me know when the
window
resets so I can avoid making it worse (I won't recreate thedomain again).
Thanks for your help!
1 Replies
21 days ago
You need to add a TXT record to _railway-verify.lms.whitail.co.jp. You can find the content for the record from the verificationToken property under status.