10 days ago
My www subdomain has a valid cert and is working fine on the same service. The apex domain has been failing for weeks. DNS is correctly set with an ALIAS record pointing to the Railway endpoint.
I've tried:
- Deleting and re-adding the domain multiple times
- Hitting "Try Again" repeatedly
Every time it either gets stuck on "Certificate Authority is validating challenges" or now shows "Failed to issue TLS certificate — An internal error occurred. Please retry or contact support."
The www subdomain resolved instantly on the same service with the same setup, so this seems like a Railway-side bug specific to apex domains. Anyone else hit this and found a fix?
2 Replies
10 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 10 days ago
10 days ago
Probably not a Railway apex bug, it's the CAA check failing on your apex. www working while the apex doesn't is the classic tell, since Let's Encrypt checks CAA on the exact name before issuing.
Run: dig CAA yourdomain.com +dnssec
Two likely causes:
- A CAA record on the root that doesn't list letsencrypt.org. Fix: add 0 issue "letsencrypt.org".
- More likely given "stuck validating then internal error": SERVFAIL on the CAA lookup, which is almost always DNSSEC. If DNSSEC is on and your nameserver signs empty responses wrong (CAA responses are usually empty), LE can't validate the apex and bails, while www resolves fine through its own path. Fix the DS records / re-sign the zone, or toggle DNSSEC off as a test and re-add the domain.
dnsviz.net on the apex will show exactly which one it is. If you see SERVFAIL, that's it, and it's a DNS-side fix, not Railway.