a month ago
Custom domain has a valid issued certificate but the edge serves no cert (SNI dropped) —
▎ please flush the edge.
▎
▎ Project mandarin-platform (3fb56e9b-8064-405a-a498-6d2a047d0b2f), production env, service
▎ wb-proxy, domain wb-proxy.mandarin-platform.ru.
▎
▎ Control plane is fully green: verified: true, DNS currentValue == requiredValue
▎ (isit92ip.up.railway.app, confirmed via authoritative NS + Google/Cloudflare/Quad9),
▎ certificateStatus: VALID, certificateStatusDetailed: COMPLETE, no certificateErrorType. A
▎ cert is listed under status.certificates (domainNames [wb-proxy.mandarin-platform.ru],
▎ issuedAt 2026-07-11T10:37:38Z, fingerprint
▎ 536ceac5059c61dd5ec7a510d46f6ca7dcfdc7ee616567a68fa4ae99907b8945).
▎
▎ But openssl s_client -connect wb-proxy.mandarin-platform.ru:443 -servername
▎ wb-proxy.mandarin-platform.ru returns "no peer certificate available" and the connection
▎ is dropped — 1.5h after issuance. The edge (69.46.46.105) is not serving the issued cert
▎ for this SNI. Redeploy, customDomainUpdate, and customDomainIssueCertificate have not
▎ caused the edge to pick it up. Please manually re-deploy/flush the certificate to the
▎ edge.
2 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
It may take up to a few hours (maybe even a day) for Railway to validate the DNS and issue certificates. If one isn't issued by then, try removing the domain from Railway and add it back after ~10-15 mins. Update DNS records as necessary.
a month ago
- delete the custom domain (wb-proxy.mandarin-platform.ru) from your service in the Railway dashboard.
- Wait about 10–15 minutes.
- Re-add the custom domain.
Also try checking any misconfigured CNAME or a trailing proxy issue.
Run a quick external query on wb-proxy.mandarin-platform.ru to see it actually resolves to isit92ip.up.railway.app.