If this issue isn't solved quickly I will change providers. Unacceptable. I requested private assistance

After seeing that 2 other people are having issues this just confirms it's a railway issue. Are you going to compensate us for downtime? How does it look to google that all of my sites have no certificate? for hours and multiple days.

Status is saying there are no lets encrypt issues https://status.railway.com/

You're not being attacked — your data is safe. This is ERR_CERT_COMMON_NAME_INVALID, which is a certificate name mismatch, not a breach. The certificate being served is a real, valid Let's Encrypt cert — the problem is that Railway's edge is presenting the wildcard certificate (*.nahltime.com) for a bare apex domain (e.g. yourdomain.com), and a wildcard doesn't cover the root name, so the browser refuses it. No attacker, no stolen passwords — just the wrong cert bound to the domain.

Root cause: This is a confirmed Railway platform bug. Railway's edge intermittently binds the wildcard cert to the apex SNI even though the correct apex certificate was issued (you can see it in the CT logs). Another Railway PRO user hit this identically (the public bounty thread on certified.one). Removing and re-adding the domain only fixes it for a few hours and burns the Let's Encrypt 5-certs-per-week limit — so don't keep doing that; it'll lock you out of issuing the apex cert for a week.

The reliable fix (already applied and confirmed working on our main domain):

Put each affected apex domain on Cloudflare and set the apex record to Proxied (orange cloud). Cloudflare terminates TLS with its own apex-valid cert and bypasses Railway's broken edge.

Cloudflare DNS-only (grey cloud) does NOT work — the browser still hits Railway's edge and gets the wildcard.

Set Cloudflare SSL/TLS mode = "Full" (not "Full (strict)" — Railway's origin only presents the wildcard, which strict mode would reject).

Keep all subdomains (www, app, tenant subdomains) DNS-only/grey so they keep using Railway's wildcard unchanged.

On Google rankings: A transient TLS handshake error does not cause a ranking penalty. Googlebot retries failed crawls automatically and there's no content/quality demotion for a temporary cert error — once the cert serves correctly, crawling and rankings recover on their own. The priority is just to get each apex behind Cloudflare so it stops recurring.

I'm not using cloudflare

Railway has cut off my sites two days in a row for hours, there will be a penalty 100%. Not to mention it looks unprofessional as fuck

Canceling my plan. Go fuck yourselves.

Enjoy your 1 star review.

https://uk.trustpilot.com/review/railway.com?stars=1

Canceled PRO plan. I expect a refund for the past 2 days of outages I don't see why I should have to pay when you have cost me downtime and wasted hours on these projects that I will have to host elsewhere.

I think I understand the fix the guy is saying and am going to implement it on mine and see I will update you and let you know how it goes

same garbage is happening to my domain.

I can help you fix it

no you cant, its a railway related issue.

I had the same issue and i got it fixed via using cloudflaire to connect the domain to railway

not using cloudflare

I was not using it too but I have to manage the situation via that

post the fix here then

create cloudflaire account and route your domain through it to railway and you will be Good

not working.

It’s working

I shouldn't have to be forced to use a third party like cloudflare. I've given railway lots of money it's unacceptable. I've cancelled my account and looking for alternatives the customer support is a joke.

Hello,

We had discovered an issue which would've affected services that have both a wildcard and exact-matching SAN for the same second-level domain, on the same service. We have been migrating traffic to our new edge network over the past week, which had tree lookup logic that erroneously preferred the wildcard certificate over the exact match, specifically if the exact-matching SAN was generated/renewed after the wildcard certificate.

We have since rolled out a fleet-wide patch to this issue, and added regression testing to make sure this doesn't happen again. We apologize for the inconvenience - please let me know if you have any further questions.