a month ago
Let's Encrypt origin certs for all 4 custom domains on this project expired without auto-renewal firing:
All 4 cert notBefore timestamps are exactly 90 days before notAfter, so these are the first-issued certs and Railway's
auto-renew job never ran on any of them. Production was masked by Cloudflare's non-strict SSL mode; pre-prod broke visibly because it uses Full (strict). Request engineering review of why the renewal job didn't trigger so I can trust the platform for future automatic renewals.
3 Replies
Status changed to Awaiting Railway Response Railway • 29 days ago
a month ago
All four domains are proxied through Cloudflare (orange cloud), and our system currently shows each one with a CNAME traffic record status of "requires update" (it can't see through Cloudflare's proxy to detect the target). Certificates for all four are stuck in an "issuing" state rather than issued. This is the root cause: Let's Encrypt HTTP-01 challenges require a plain HTTP request to reach our origin, but Cloudflare's proxy intercepts that path. With Full (Strict) mode on pre-prod, the challenge is additionally blocked because strict mode demands a valid origin cert, which can't exist yet during renewal. The recommended fix is to temporarily disable Cloudflare proxying (grey cloud) on each domain so we can complete the ACME challenge, then re-enable the proxy once certificates show as issued in the dashboard. For ongoing reliability, set Cloudflare to Full (not Full Strict) on all environments. Our SSL troubleshooting docs cover this in detail under the "Toggle Trick" and Cloudflare sections.
Status changed to Awaiting User Response Railway • 29 days ago
a month ago
Thank you for your answer. I greyed out all proxied CNAMEs and changed the CF settings to Full instead of Full strict. If you can complete the ACME challange? Thanks in advance
Status changed to Awaiting Railway Response Railway • 29 days ago
a month ago
This thread has been marked as public for community involvement, as it does not contain any sensitive or personal information. Any further activity in this thread will be visible to everyone.
Status changed to Open Railway • 29 days ago
dardameiz
Thank you for your answer. I greyed out all proxied CNAMEs and changed the CF settings to Full instead of Full strict. If you can complete the ACME challange? Thanks in advance
a month ago
Try removing related DNS records from your DNS provider and Railway, wait ~10-15 mins, and see if the certificates get re-issued.
Status changed to Solved dardameiz • 28 days ago