a month ago
Custom domain www.apexaiediting.com (project photo-to-video, service web, current target ugajpkzx.up.railway.app) is down: the TLS handshake times out and the edge presents no certificate at all (openssl s_client → "no peer certificate available"). The default *.up.railway.app domain for the same service works perfectly, so the app is healthy — it's specific to the custom domain.
Key detail: certificate issuance is working fine. Certificate Transparency logs show valid Let's Encrypt certs for this domain, including one valid through 2026-09-14 and a fresh one issued today (2026-07-17 17:27 UTC). So Let's Encrypt is issuing certs — your edge simply isn't attaching/serving one for this SNI.
DNS is correct and fully propagated (verified via Google, Cloudflare, and the authoritative nameservers): CNAME www → ugajpkzx.up.railway.app, plus the _railway-verify.www TXT record. I've already removed and re-added the domain and redeployed; no change.
Context that may matter: this project was migrated from a different Railway account several months ago. The previous owner confirms he no longer has any project for this domain, so if there's a stale/orphaned domain claim from the old (now-removed) project, it's on your platform side and I can't clear it.
Could you please investigate why the edge isn't serving the issued certificate for this hostname, and release any orphaned domain claim tied to the prior project/account? Live site with paying customers, so any prioritization is appreciated. Happy to provide project IDs or run diagnostics.
Thanks,
Adam
6 Replies
a month ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 1 month ago
a month ago
Your domain is currently working just fine. If the issue is still present, it might be just a caching issue. Try to access it from an incognito tab, or use a different network/device
Attachments
darseen
Your domain is currently working just fine. If the issue is still present, it might be just a caching issue. Try to access it from an incognito tab, or use a different network/device 
a month ago
Appreciate the response. Tried it on cellular and it worked.... no idea why this happened.... Still not working on my computer (even on other browsers) Ill try tomorrow on my hotspot
mullinsmedia
Appreciate the response. Tried it on cellular and it worked.... no idea why this happened.... Still not working on my computer (even on other browsers) Ill try tomorrow on my hotspot
a month ago
This confirms the caching issue. You can try flushing DNS cache, clearing your browser's cache etc. But the problem will be resolved eventually.
darseen
This confirms the caching issue. You can try flushing DNS cache, clearing your browser's cache etc. But the problem will be resolved eventually.
a month ago
It worked for a few hours then went down again with a different error
Claude Code says....
web-production-799bb.up.railway.app (my service's default domain) → works perfectly: TLSv1.3, TLS_AES_256_GCM_SHA384, valid CN=*.up.railway.app Let's Encrypt cert, Verify return code: 0 (ok), HTTP 200.
0sgf2h6a.up.railway.app (the target you assigned to www.apexaiediting.com) → fails: SSL routines: tls_validate_record_header: wrong version number, no peer certificate available, Cipher is (NONE). curl reports tlsv1 alert protocol version.
www.apexaiediting.com (CNAMEs to that target) → identical failure, browsers show ERR_SSL_PROTOCOL_ERROR.
wrong version number means that endpoint is not serving TLS at all on port 443. Note 0sgf2h6a.up.railway.app is itself a *.up.railway.app hostname, so it should be covered by the same wildcard cert that works on my default domain — it isn't.
DNS is validated (green checkmark in dashboard, CNAME + TXT correct). I've completed your remove / 10-min wait / re-add procedure. This is the third assigned target and all have failed the same way.
Please provision a working edge endpoint for this domain or fix the TLS terminator on 0sgf2h6a.up.railway.app. This is a platform-side failure, not a configuration issue on my end.
holsterjr10
Just try removing the domain and then adding it back after 10 mins.
a month ago
It worked for a few hours then went down again with a different error
Claude Code says....
web-production-799bb.up.railway.app (my service's default domain) → works perfectly: TLSv1.3, TLS_AES_256_GCM_SHA384, valid CN=*.up.railway.app Let's Encrypt cert, Verify return code: 0 (ok), HTTP 200.
0sgf2h6a.up.railway.app (the target you assigned to www.apexaiediting.com) → fails: SSL routines: tls_validate_record_header: wrong version number, no peer certificate available, Cipher is (NONE). curl reports tlsv1 alert protocol version.
www.apexaiediting.com (CNAMEs to that target) → identical failure, browsers show ERR_SSL_PROTOCOL_ERROR.
wrong version number means that endpoint is not serving TLS at all on port 443. Note 0sgf2h6a.up.railway.app is itself a *.up.railway.app hostname, so it should be covered by the same wildcard cert that works on my default domain — it isn't.
DNS is validated (green checkmark in dashboard, CNAME + TXT correct). I've completed your remove / 10-min wait / re-add procedure. This is the third assigned target and all have failed the same way.
Please provision a working edge endpoint for this domain or fix the TLS terminator on 0sgf2h6a.up.railway.app. This is a platform-side failure, not a configuration issue on my end.