Custom domain certificate stuck in VALIDATING_OWNERSHIP for 24+ hours, DNS verified propagated

liusarah35-oss

HOBBYOP

a month ago

Project payapphq (3ed9b229-5b13-4b98-95ea-a509e07a7f15), service demo, custom domain demo.payapphq.com. Your API reports the CNAME as DNS_RECORD_STATUS_PROPAGATED but certificateStatus has been stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for over 24 hours. I deleted and re-added the domain once (new target issued and configured promptly); same result. The domain has no CAA records and no DNSSEC. DNS is Cloudflare, record was un-proxied (DNS only) during both attempts. Please re-trigger issuance or advise. Note: the record is currently proxied through Cloudflare as a temporary workaround — happy to flip it back to DNS-only for your testing.

$10 Bounty

2 Replies

Railway

BOT

a month ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway • 30 days ago

darseen

HOBBYTop 5% Contributor

a month ago

You need to add a TXT record for _railway-verify.demo.payapphq.com. If you are using the API to add your custom domain, you can find it in verificationToken under status.

Anonymous

HOBBY

18 days ago

oject 59fdbc5d-9c1b-46fb-909c-14801b187283, service "web" (529ddc3b-eda2-4f33-8b72-3f5fad649ba8), environment production, region europe-west4.

Custom domain www.bs-vtc.fr (binding d9fb6750-5413-45b7-83c3-1410db0935a9, target xuhvnjeo.up.railway.app) has been stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for hours, across five recreated bindings (targets mflfrgh4, hzdbx77z, did8n3r0, 0zxz13q1, xuhvnjeo), both apex and www.

Verified on my side:

DNS is a literal CNAME www.bs-vtc.fr -> xuhvnjeo.up.railway.app, unproxied (Cloudflare DNS-only), TTL 60, propagated globally (Google and Cloudflare DoH agree).
- Your API confirms visibility: dnsRecords.currentValue returns exactly the requiredValue, status DNS_RECORD_STATUS_PROPAGATED.
- Your edge answers for the hostname with the .up.railway.app wildcard certificate but returns 404, including on /.well-known/acme-challenge/.
- Upgraded Trial -> Hobby mid-investigation; no change.
- The generated domain web-production-f9725.up.railway.app serves the site perfectly (200).

Please unstick certificate issuance/routing for this domain, or tell me what the validator is rejecting: the public status exposes nothing actionable.

Welcome!