Custom domain sit.banbunchee.co.th is stuck in cert provisioning.

State:

- Domain ID: fb95cd9f-100b-4c0f-919a-059a371be713

- Project: bbp-office-sit (ba938aad-a024-49d0-bfb2-e3110b09c1de)

- Service: bbp-app (b75b2eb4-7ece-47fd-863b-68bf36dbe425)

- Environment: production (56b49d6c-3412-4ce9-b585-2b3d0d246596)

- Region: Southeast Asia

- targetPort: 3000

- CNAME target: yn7r1svj.up.railway.app

- syncStatus / DNS: PROPAGATED (confirmed via GraphQL customDomain.status.dnsRecords)

- status.certificates: [] (empty for 6+ hours)

- Server response on https://sit.banbunchee.co.th: TLS handshake serves

default wildcard cert CN=*.up.railway.app instead of a cert for the

custom domain.

Already tried:

1. Delete and recreate the custom domain

2. Explicitly set targetPort=3000 via customDomainUpdate

3. Redeploy the service

4. Verify no CAA records and no DNSSEC blocking Let's Encrypt

DNS:

$ dig CNAME sit.banbunchee.co.th @8.8.8.8

sit.banbunchee.co.th. 300 IN CNAME yn7r1svj.up.railway.app.

Please trigger cert issuance or share what's blocking on Railway's side.