a month ago
Project 7f8aafa3-e169-4b71-a997-2fb4f22225c9, env production (56194dbe-3bfb-4bee-a028-ce9295d7bd00), service prosciej-api (949de711-1ab0-4641-bcbb-e75bd2b600c0), custom domain api.prosciej.com (current id 96634190-4910-44f1-bd14-dcfcca6ca1bd, edgeId edge-6705e5cc5ae5e82ae931d2b1f900f08f). DNS fully propagated (CNAME api -> 03gme72z.up.railway.app matches requiredValue, TXT _railway-verify.api present and resolvable). CAA on apex permits letsencrypt.org/pki.goog/sectigo.com. API confirms status.verified=true and status.certificateStatus=CERTIFICATE_STATUS_TYPE_VALID.
But requests to https://api.prosciej.com/healthz/ intermittently get the correct Let's Encrypt cert (CN=api.prosciej.com) vs a fallback *.up.railway.app wildcard cert that fails hostname verification — same client, same server IP (69.46.46.40) each time, so it's not DNS/routing, it's inconsistent between edge replicas serving this domain. Measured ~50% failure rate over 60 checks / 6 minutes with no improving trend (max streak 3 consecutive successes). Already tried: customDomainIssueCertificate retry (no change), and a full delete+recreate of the custom domain (old id c35d85fd-8f4a-4485-8a11-e1f49ce9b0d6 -> new id above, with CNAME updated to the new target). Could you check why the edge fleet isn't consistently serving the issued cert for this domain?
Pinned Solution
a month ago
I'd try removing the domain from Railway and add it back after ~10-15 mins. Update DNS records as necessary.
2 Replies
a month ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 1 month ago
a month ago
I'd try removing the domain from Railway and add it back after ~10-15 mins. Update DNS records as necessary.
0x5b62656e5d
I'd try removing the domain from Railway and add it back after ~10-15 mins. Update DNS records as necessary.
a month ago
Thanks, that fixed it! Deleted the custom
domain, waited a full ~13 minutes (not
immediately), then recreated it and
updated the CNAME to the new target
Railway gave us. Certificate went VALID,
ownership verified=true, and 20/20
consecutive requests succeeded afterward
-- stable. Marking this resolved.
Status changed to Solved 0x5b62656e5d • about 1 month ago