Custom domain stuck at VALIDATING_OWNERSHIP despite correct & propagated CNAME (suspected Let's Encrypt rate limit)
tettyshirao-whitail
HOBBYOP

22 days ago

Hi Railway team,

A custom domain on my service is stuck issuing its TLS certificate

and I'd

appreciate a manual re-trigger or guidance.

Details

  • Project: whitail-lms (id: 09759d6e-bd0e-4743-a04c-90dc1ea46f7c)
  • Service: whitail-lms-web (id:

2963fde1-dd97-4d3e-a55e-8f6aa904b73b)

  • Environment: production
  • Custom domain: lms.whitail.co.jp
  • Required CNAME target: jxomlsm1.up.railway.app

Current state

  • The CNAME is correct, DNS-only (unproxied through Cloudflare),

and fully

propagated. Railway's own dashboard reports the DNS record as

PROPAGATED

with a matching currentValue (jxomlsm1.up.railway.app).
  • Despite this, certificateStatus has remained

VALIDATING_OWNERSHIP for over

18 minutes after the correct DNS was detected, and the cert is

never issued.

Visiting https://lms.whitail.co.jp returns an SSL error (no

valid cert).

What I already tried

  • Verified the CNAME from multiple public resolvers (1.1.1.1,

8.8.8.8) — all

return jxomlsm1.up.railway.app.
  • Confirmed Cloudflare Proxy is OFF (DNS-only), so validation

isn't blocked.

  • I deleted and recreated the custom domain a few times earlier

while fixing

the CNAME, so I suspect this hostname hit a Let's Encrypt rate

limit.

Request

  1. Could you manually re-trigger / force re-issuance of the

certificate for

 lms.whitail.co.jp?

2. If it's a Let's Encrypt rate limit, please let me know when the

window

 resets so I can avoid making it worse (I won't recreate the

domain again).

Thanks for your help!

1 Replies

You need to add a TXT record to _railway-verify.lms.whitail.co.jp. You can find the content for the record from the verificationToken property under status.


Welcome!

Sign in to your Railway account to join the conversation.

Loading...