Custom domain certificate stuck in "Issuing certificate" for 14+ hours
winstoneworld
HOBBYOP

a day ago

Custom domain radio.mixmix.tv on service mixmix-icecast has been stuck at

certificate status VALIDATING_OWNERSHIP for over 14 hours.

  • Project: mixmix-ffmpeg (f72ac10f-bb63-485e-8492-42ed0b19dca0)

  • Environment: production (b8ff45aa-9a69-4bb4-835a-326d03b120ff)

  • Service: mixmix-icecast (c1e014e2-a6b7-4812-a4c9-4013e6dd3e1a)

  • Custom domain id: 4b58ac7a-a44d-4ef1-839d-696952f09be7 (recreated once already;

    previous id 180d6041-d053-4b0b-a6ba-6a458df2818b had the same issue)

Verified on my side:

  • Authoritative DNS serves CNAME radio.mixmix.tv → ranwolyj.up.railway.app

    (dashboard shows DNS_RECORD_STATUS_PROPAGATED)

  • Port 80 for this hostname routes to the Railway edge

    (301 to https, x-railway header present)

  • /.well-known/acme-challenge/* is answered directly by the edge

    (plain 404, no redirect)

  • No CAA records on the domain or its parents; zone is not DNSSEC-signed

  • Port 443 still serves the default *.up.railway.app certificate

Additional context from browsing similar community threads:

  • I noticed other threads suggest removing the domain and re-adding it after a

    10-15 min wait. I've already deleted and re-created this domain once during

    troubleshooting (see custom domain id history above), but did not wait the

    recommended 10-15 minutes between removal and re-creation — happy to try

    again with proper timing if that's likely to help.

  • Given the domain was deleted and re-created, could you also check whether

    this hit a Let's Encrypt rate limit for this hostname?

Could you check what is blocking certificate issuance on your side, and let

me know if a rate limit or backend verification issue is the cause?

Solved$10 Bounty

Pinned Solution

You need to add a TXT record to _railway-verify.radio.mixmix.tv. If you're using the API, you can find the content for it from the verificationToken property under status.

2 Replies

Railway
BOT

a day ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway 1 day ago


You need to add a TXT record to _railway-verify.radio.mixmix.tv. If you're using the API, you can find the content for it from the verificationToken property under status.


0x5b62656e5d

You need to add a TXT record to `_railway-verify.radio.mixmix.tv`. If you're using the API, you can find the content for it from the `verificationToken` property under `status`.

winstoneworld
HOBBYOP

a day ago

Solved — thanks! Turned out I was missing the _railway-verify.radio TXT record (Railway's dnsRecords API response only showed the CNAME, so I missed it). Added the TXT record + fixed the CNAME target (it had changed after re-creating the domain), and the certificate issued within minutes. Also confirmed via docs.railway.com — will avoid deleting/re-adding domains going forward to stay clear of the LE rate limit.


Status changed to Solved 0x5b62656e5d 1 day ago


Welcome!

Sign in to your Railway account to join the conversation.

Loading...