Hello Railway Support,

I am having a custom-domain SSL/provisioning issue with my production API.

Custom domain:

api.***********.com

Working Railway service domain:

Project: *************

Project ID:

51be2392-aaf5-4fca-a61f-ea511ca5f652

Service ID:

7e657c23-7c41-438c-9548-1eb86af79ff8

Environment ID:

95ebbf2c-d1f8-46c9-b020-33a3aed75efb

Environment:

Production

PROBLEM

The Railway-provided domain works correctly and reaches my Node/Express API.

The custom domain api.***.com also resolves to Railway successfully, but Railway is presenting a *.up.railway.app SSL certificate instead of a certificate valid for api..com.

Because of this, HTTPS requests to the custom domain fail hostname verification.

DNS RESULTS

Authoritative nameservers:

dns4.p03.nsone.net.

dns3.p03.nsone.net.

dns1.p03.nsone.net.

dns2.p03.nsone.net.

Custom-domain CNAME:

api.********com. 3600 IN CNAME lnai1596.up.railway.app.

Railway target resolution:

lnai1596.up.railway.app. 60 IN A 69.46.46.51

Cloudflare's public resolver (1.1.1.1) returns the same CNAME and Railway IP, so the routing CNAME is publicly propagated.

CUSTOM DOMAIN TLS RESULT

Connecting to:

successfully reaches:

69.46.46.51:443

TLS negotiation begins successfully, but Railway serves this certificate:

subject: CN=*.up.railway.app

The resulting error is:

subjectAltName does not match host name api.filladsnow.com

SSL: no alternative certificate subject name matches target host name 'api.filladsnow.com'

DIRECT RAILWAY DOMAIN TEST

The Railway-provided domain works correctly:

It resolves, completes TLS successfully, and its certificate verifies correctly:

subject: CN=*.up.railway.app

subjectAltName matches filladsnow-api-production.up.railway.app

issuer: Let's Encrypt

SSL certificate verify ok.

The request then reaches my Express application and returns:

HTTP/2 401

This 401 is expected because I intentionally made the diagnostic request without the application API key.

Therefore, the deployed application itself is reachable and operating correctly through Railway's provided domain.

REQUEST FOR RAILWAY

Could you please inspect the Railway custom-domain record for:

api.*******.com

Specifically, could you check:

The custom-domain ownership/TXT verification status.

Whether Railway considers the domain fully verified.

Whether SSL certificate issuance for api.filladsnow.com has failed or become stuck.

Whether the domain is correctly attached to the Production service/environment.

Railway edge routing/SNI configuration for api.********com.

Whether certificate issuance can be manually retried/reset from Railway's side if necessary.

If Railway requires a new or updated TXT ownership-verification record, please provide the exact TXT hostname and value that should be configured.

The routing CNAME is publicly resolving to the Railway-provided target, but Railway is currently serving the .up.railway.app certificate instead of a certificate containing api.********.com.

Thank you.