this issue is usually caused by the certificate authority being unable to verify ownership of the custom domain. First, ensure the domain is correctly verified in Railway and that the DNS records exactly match those shown in the Railway dashboard. If you're using Cloudflare, set the DNS record to DNS Only (gray cloud) instead of Proxied (orange cloud), as proxying can prevent the SSL challenge from completing. Verify that there are no conflicting DNS records (such as both an A record and a CNAME for the same hostname), that any required TXT verification record is present, and that no restrictive CAA records are blocking Let's Encrypt from issuing the certificate. If the DNS configuration is correct, remove the custom domain from Railway, wait a few minutes, and add it again to trigger a new certificate request. Since DNS changes can take time to propagate globally, waiting up to an hour may also resolve the issue. If the certificate remains stuck on "Validating challenges" after these checks, the problem is likely on Railway's side, and the recommended solution is to contact Railway support or post in the Railway community to have them manually retry or trigger the SSL certificate issuance.

This did not work unfortunately

Already did all this and domain verified and dns all good. txt are there and dns progagation is done: still nothing

It's now been well over an hour and it's still stuck on "Certificate Authority is validating challenges." Since the DNS configuration is confirmed correct, this looks like it's on Railway's side.

Could a Railway team member please manually retry / trigger the SSL certificate issuance for app.mafacture.ca? Happy to provide the project/service IDs if needed. Thank you!