Hi team, The custom domain bi.idolem.com on service idolem-bi-dashboard is stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for 4+ hours and never issues a certificate. Identifiers: - Project: 36740087-756f-449b-9766-7aa69ec01ecf (production env 96a28062-99bc-4bb2-a5d7-5d7f48ca61c0) - - Service: idolem-bi-dashboard (40f33918-51ac-4ee8-9988-341657c89250) - - Custom domain id: 1cdd0b68-15dc-4357-bd81-816f290ab6f1 - - Domain: bi.idolem.com -> CNAME 0cb2d2wo.up.railway.app Everything on our side is correct: - Your API reports the DNS record matched and propagated: requiredValue == currentValue == 0cb2d2wo.up.railway.app, status DNS_RECORD_STATUS_PROPAGATED. - - No CAA record on idolem.com, no DNSSEC misconfig, service is Online. - - bi.idolem.com is a clean CNAME with no conflicting records. - - The service native *.up.railway.app domain has a valid cert, so the service itself is fine. We believe we hit a Let's Encrypt rate limit. While troubleshooting we deleted and re-created the custom domain ~3 times; each recreate assigned a new CNAME target and started a fresh ACME order that failed because DNS had not yet caught up to the new target. Those repeated failed orders appear to have rate-limited issuance for this hostname. Could you please force certificate issuance for bi.idolem.com on your end, or tell us exactly when the rate limit clears? We specifically do NOT want to delete/re-create the domain again, since that risks the 5-duplicate-certs-per-week limit and a 7-day lockout. The domain is configured correctly and stable now; it just needs a successful ACME order. Thanks a lot!

Custom domain bi.idolem.com stuck in VALIDATING_OWNERSHIP for 4+ hours (likely Let's Encrypt rate limit)

shadow2256

PROOP

a month ago

Hi team,

The custom domain bi.idolem.com on service idolem-bi-dashboard is stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for 4+ hours and never issues a certificate.

Identifiers:

Project: 36740087-756f-449b-9766-7aa69ec01ecf (production env 96a28062-99bc-4bb2-a5d7-5d7f48ca61c0)
- Service: idolem-bi-dashboard (40f33918-51ac-4ee8-9988-341657c89250)
- Custom domain id: 1cdd0b68-15dc-4357-bd81-816f290ab6f1
- Domain: bi.idolem.com -> CNAME 0cb2d2wo.up.railway.app

Everything on our side is correct:

Your API reports the DNS record matched and propagated: requiredValue == currentValue == 0cb2d2wo.up.railway.app, status DNS_RECORD_STATUS_PROPAGATED.
- No CAA record on idolem.com, no DNSSEC misconfig, service is Online.
- bi.idolem.com is a clean CNAME with no conflicting records.
- The service native *.up.railway.app domain has a valid cert, so the service itself is fine.

We believe we hit a Let's Encrypt rate limit. While troubleshooting we deleted and re-created the custom domain ~3 times; each recreate assigned a new CNAME target and started a fresh ACME order that failed because DNS had not yet caught up to the new target. Those repeated failed orders appear to have rate-limited issuance for this hostname.

Could you please force certificate issuance for bi.idolem.com on your end, or tell us exactly when the rate limit clears? We specifically do NOT want to delete/re-create the domain again, since that risks the 5-duplicate-certs-per-week limit and a 7-day lockout. The domain is configured correctly and stable now; it just needs a successful ACME order.

Thanks a lot!

Solved$20 Bounty

Pinned Solution

shadow2256

PROOP

a month ago

Resolved. Root cause was the missing ownership TXT record, not a rate limit. Railway requires both the routing CNAME (in status.dnsRecords) and a separate ownership TXT from status.verificationToken, which is easy to miss because it is not listed in dnsRecords. I added TXT _railway-verify.bi = railway-verify= at our DNS provider, and the certificate issued within about 2 minutes. Thanks h701h for pointing at the verify record.

3 Replies

Railway

BOT

a month ago

This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.

Status changed to Open Railway • about 1 month ago

darseen

HOBBYTop 5% Contributor

a month ago

.

h701h

FREE

a month ago

It may take up to a few hours (maybe even a day) for Railway to validate the DNS and issue certificates.

Make sure you added the TXT record at _railway-verify.bi.idolem.com

You can find the content for it from the verificationToken property under status.

1

shadow2256

PROOP

a month ago

Resolved. Root cause was the missing ownership TXT record, not a rate limit. Railway requires both the routing CNAME (in status.dnsRecords) and a separate ownership TXT from status.verificationToken, which is easy to miss because it is not listed in dnsRecords. I added TXT _railway-verify.bi = railway-verify= at our DNS provider, and the certificate issued within about 2 minutes. Thanks h701h for pointing at the verify record.