3 hours ago
Subject: Custom domain certificates stuck in VALIDATING_OWNERSHIP for 12+ hours (DNS verified PROPAGATED)
Project: enchanting-vision (81e2ac54-f0d4-4a04-84ef-eda698540844)
Environment: production (6a16e5c3-f07a-4825-8bd0-f044958f01d0)
Affected custom domains:
- api.shalav.app — id a4b3ffad-4a12-4334-8e49-8ad1fc577446, service inhouse-ai (061a5bae-a0ea-468b-b080-8bf5b81341c7), target port 8000
- app.shalav.app — id 24951187-084a-42d8-bc8a-195e96cfd71b, service innovative-balance (60db9343-7f7e-4972-9e3d-4d4e06df8c40), target port 3000
Timeline (UTC):
- Aug 10 ~17:00 — both domains added. CNAMEs created at the registrar (Porkbun) within minutes.
- Stuck in CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for ~1.5h, so we deleted and re-added both domains (fresh ids above).
- 12+ hours later, both are still VALIDATING_OWNERSHIP.
Evidence that our side is correct:
- Your own API reports dnsRecords status DNS_RECORD_STATUS_PROPAGATED for both, with currentValue exactly matching requiredValue (api → mxcdh6v5.up.railway.app, app → qadrs7rh.up.railway.app).
- Let's Debug (letsdebug.net) test #3102163 for api.shalav.app, method http-01: zero problems found — ACME path reachable, no CAA restrictions, no DNSSEC issues, no rate limiting.
- http://api.shalav.app/.well-known/acme-challenge/probe returns your edge's 404 (host routing on port 80 works).
- The domain shalav.app is newly registered (Aug 11 05:08 UTC) at Porkbun, DNSSEC disabled.
Could you kick/retry certificate issuance for these two domains, or let us know what is blocking it on your side?
1 Replies
3 hours ago
Both domains are missing their TXT ownership-verification records, which is why they remain in VALIDATING_OWNERSHIP with verified=false. The CNAME records are correct and propagated, but certificates will not issue until the TXT records are also in place. In Porkbun, create two TXT records using the verification values shown in your Railway dashboard under each domain's settings: one at host _railway-verify.api (for api.shalav.app) and one at host _railway-verify.app (for app.shalav.app). The full token values are displayed next to each domain in the dashboard. Once both propagate, verification and certificate issuance should proceed automatically. Reply here after adding them and we can re-check.
Status changed to Awaiting User Response Railway • about 3 hours ago