16 days ago
Hi Railway
Project: sumday (09b42166-c111-48a0-b081-59bcbb335824)
Environment: production (d18feb4b-99b3-473b-aafb-ff993f7b38a9)
Service: sumday-web
Domains: sumday.dev, www.sumday.dev — both already attached (railway domain confirms)
Problem: Neither custom domain serves a valid certificate. Both present CN=*.up.railway.app, which doesn't cover them. Since .dev is HSTS-preloaded, browsers refuse with no click-through, so the site is unreachable. DNS was pointed 15:19 PDT 2026-08-04, ~22h ago. Last observed status on both: CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP, certificateErrorType: null.
DNS (Porkbun, no proxy/CDN):
- ALIAS sumday.dev → 6euq0mwc.up.railway.app → resolves 69.46.46.122
- CNAME www.sumday.dev → otci28zj.up.railway.app → resolves 69.46.46.49
Both resolve to exactly what the Railway targets resolve to. ALIAS at apex since CNAME is invalid at a zone root.
Ruled out:
- No CAA records
- No DNSSEC
- /.well-known/acme-challenge/ answered by railway-edge — HTTP-01 reachable
- Not behind Cloudflare
- Removed a Porkbun wildcard CNAME (*.sumday.dev → pixie.porkbun.com) that was shadowing _acme-challenge.sumday.dev; that name is now clear and the cert still hasn't issued
- Service healthy — sumday-web-production.up.railway.app serves fine
Questions:
- Is issuance stuck, erroring, or Let's Encrypt rate-limited for sumday.dev?
- Which challenge type is used for an apex ALIAS domain — HTTP-01 or DNS-01?
- Is a TXT verification record required? Docs say yes; the dashboard never showed one for these domains.
I have not removed and re-added the domains, to avoid target-hostname reassignment and burning Let's Encrypt duplicate-cert attempts. Advise before I do.
1 Replies
16 days ago
Both domains show as unverified because the required TXT ownership-verification records are missing. Your CNAME/ALIAS traffic-routing records are propagated correctly, but certificates will not issue until each domain also has its TXT verification record. In your Porkbun DNS, create a TXT record at the host _railway-verify (for the apex) and another at _railway-verify.www (for the www subdomain), each with the verification value shown in the Railway dashboard under that domain's settings. Once those TXT records propagate, verification completes and certificate issuance proceeds automatically.
Status changed to Awaiting User Response Railway • 16 days ago
9 days ago
This thread has been marked as solved automatically due to a lack of recent activity. Please re-open this thread or create a new one if you require further assistance. Thank you!
Status changed to Solved Railway • 9 days ago