Your DNS records are correct: the CNAME is propagated and the TXT verification token at _railway-verify.book.23amblesideretreat.co.za matches exactly. The verification workflow stalled while the earlier DNS inconsistency was in place and never re-ran after your fix. We have started a certificate re-issuance for this domain, which should complete within a few minutes.

The domain is still serving your platform's default certificate, not one for our domain.

Certificate presented at book.23amblesideretreat.co.za:

Subject CN: *.up.railway.app

Subject Alt Names: *.up.railway.app, up.railway.app

Issuer: Let's Encrypt YE1

Valid: 29 Jul 2026 – 27 Oct 2026

Serial: 06:DA:79:BB:56:1D:A3:EF:EB:0E:75:1C:A2:1A:BD:39:99:FE

No SAN covers book.23amblesideretreat.co.za, so browsers report a domain mismatch and refuse the connection. The validity dates show this certificate predates the re-issuance you began today by several weeks — so no new certificate has been issued or deployed for our domain.

Please confirm the status of the ACME order for this domain and whether validation failed. Our DNS is confirmed correct on your side, and there are no CAA records on the zone restricting issuance.

The certificate re-issuance has completed successfully: the domain is now verified, the certificate status is valid, and edge routing is responding normally (HTTP 200). The *.up.railway.app wildcard certificate you observed was served from a cached TLS session before the new certificate finished deploying. If your browser still shows the mismatch, close all tabs to that domain and reconnect, or test in an incognito window, so a fresh TLS handshake picks up the new certificate.