5 days ago
Project: step-certified (e26ea6d4-5ac0-40a4-a2cf-2c8500c08ed6), environment production (930ff3a0-2efd-4af5-9502-238ae2841aa1), service web (61e57e8a-e0d0-498e-a70f-a7964add388b).
Both custom domains have been stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for several hours:
- stepcertified.com (domain id 0a53700e-4d31-47b7-96f3-a3a92bad151d, target o0lxav6i.up.railway.app)
-
- www.stepcertified.com (domain id d4274011-fe1e-4ab8-b894-03f3dd6ea053, target kbk8j5vc.up.railway.app)
The edge is serving the *.up.railway.app wildcard cert, so browsers show ERR_CERT_COMMON_NAME_INVALID on our production domain.
What we have verified on our side:
- Your API reports both domains DNS_RECORD_STATUS_PROPAGATED.
-
- Zone is on Cloudflare with DNS-only (grey cloud) records. www is a plain CNAME to kbk8j5vc.up.railway.app; the apex is CNAME-flattened and resolves to 69.46.46.98, which exactly matches o0lxav6i.up.railway.app.
-
- No CAA records exist on the domain, so Let's Encrypt is not blocked.
-
- Plain HTTP requests to /.well-known/acme-challenge/ on both hostnames get a 404 from railway-edge, so the validation path reaches you cleanly.
-
- We have called the customDomainIssueCertificate mutation repeatedly for both domain ids; it returns true but the status never leaves VALIDATING_OWNERSHIP.
-
- No incident is listed on status.railway.com.
Could you take a look at what is blocking issuance and clear it? Happy to provide anything else you need.
1 Replies
5 days ago
Both domains are missing the TXT ownership-verification records, which is why they stay at VALIDATING_OWNERSHIP. The CNAME traffic records are propagated, but Railway also requires a TXT record per domain to confirm ownership before it will issue a certificate. In Cloudflare, add TXT records (DNS-only/grey cloud) at the hostnames shown in the Railway dashboard: one for the apex domain at _railway-verify and one for the www subdomain at _railway-verify.www, each with the verification value the dashboard provides. Once those propagate, verification should complete and certificates will issue automatically. Reply here once they are in place and we can re-check the status.
Status changed to Awaiting User Response Railway • 5 days ago
Status changed to Solved brianpinkus • 4 days ago