**Subject:**Custom domain shows verified (green) but no TLS certificate is ever issued — issuance silently stuck

Summary — Custom domain on service sageway displays a green DNS-verified check (port 8080) and routes HTTP traffic to my running deployment, but no TLS certificate is ever issued — HTTPS handshakes reset and the edge presents no cert. No error or notification anywhere. Remove/re-add and a full redeploy haven't cleared it. Looks like an internal desync between the routing layer and the cert-provisioning subsystem.

Environment

• Project: sageway — b74aaa01-bb08-45b2-895c-fd4c8e9fdd1c
• Environment: production — 275ca1b9-fee9-4726-8de7-cacfb6b0cd3a
• Service: sageway — 582ef6ed-7671-41d5-8794-cd7c89fa58f9
• Custom domain: assigned CNAME target mlm2i6ky.up.railway.app
• Working default domain: → 200

Symptoms — green DNS check + port 8080 in UI; openssl s_client … -servername <custom domain> → no peer certificate available; `curl → connection reset (exit 35); ports 80/443 accept TCP; no ACME error surfaced anywhere.

DNS is correct (not the cause) — CNAME consistent across all major resolvers, _railway-verify TXT present, no conflicting records, DNSSEC valid (not bogus), no blocking CAA.

The desync — custom domain is absent from the active serviceDomains config (only the .up.railway.app domain is listed) despite showing green and routing in the dashboard — a staged/partial state where issuance never fires. Possibly hit a Let's Encrypt failed-validation rate-limit backoff.

Already tried (no help) — (1) remove + re-add; (2) full redeploy 036aa275-3957-4e1b-b04d-e09d56f024f9 (SUCCESS).

Ask — Force/repair cert issuance for this domain (clear stuck state + re-commit to active config), or tell us the cert subsystem's state / any rate-limit backoff to wait out. We've stopped removing/re-adding to avoid compounding backoff.