**Subject:**Custom domain shows verified (green) but no TLS certificate is ever issued — issuance silently stuck **Summary** — Custom domain on service **sageway** displays a green DNS-verified check (port 8080) and routes HTTP traffic to my running deployment, but **no TLS certificate is ever issued** — HTTPS handshakes reset and the edge presents no cert. No error or notification anywhere. Remove/re-add and a full redeploy haven't cleared it. Looks like an internal desync between the routing layer and the cert-provisioning subsystem. **Environment** - Project: sageway — `b74aaa01-bb08-45b2-895c-fd4c8e9fdd1c` - Environment: production — `275ca1b9-fee9-4726-8de7-cacfb6b0cd3a` - Service: sageway — `582ef6ed-7671-41d5-8794-cd7c89fa58f9` - Custom domain: assigned CNAME target `mlm2i6ky.up.railway.app` - Working default domain: → 200 **Symptoms** — green DNS check + port 8080 in UI; `openssl s_client … -servername ` → `no peer certificate available`; `curl → connection reset (exit 35); ports 80/443 accept TCP; **no ACME error surfaced anywhere**. **DNS is correct (not the cause)** — CNAME consistent across all major resolvers, `_railway-verify` TXT present, no conflicting records, DNSSEC valid (not bogus), no blocking CAA. **The desync** — custom domain is **absent from the active `serviceDomains`** config (only the `.up.railway.app` domain is listed) despite showing green and routing in the dashboard — a staged/partial state where issuance never fires. Possibly hit a Let's Encrypt failed-validation rate-limit backoff. **Already tried (no help)** — (1) remove + re-add; (2) full redeploy `036aa275-3957-4e1b-b04d-e09d56f024f9` (SUCCESS). **Ask** — Force/repair cert issuance for this domain (clear stuck state + re-commit to active config), or tell us the cert subsystem's state / any rate-limit backoff to wait out. We've stopped removing/re-adding to avoid compounding backoff.

I can access it just fine. Try accessing the site from an incognito browser or a different device/network. ![13850.png](https://station-server.railway.com/attachments/att_01kvcpaqx9e4a80sh3nbkt5kvm)

Custom domain shows verified (green) but no TLS certificate is ever issued — issuance silently stuck

tarikaltuncu

FREEOP

2 months ago

**Subject:**Custom domain shows verified (green) but no TLS certificate is ever issued — issuance silently stuck

Summary — Custom domain on service sageway displays a green DNS-verified check (port 8080) and routes HTTP traffic to my running deployment, but no TLS certificate is ever issued — HTTPS handshakes reset and the edge presents no cert. No error or notification anywhere. Remove/re-add and a full redeploy haven't cleared it. Looks like an internal desync between the routing layer and the cert-provisioning subsystem.

Environment

Project: sageway — b74aaa01-bb08-45b2-895c-fd4c8e9fdd1c
Environment: production — 275ca1b9-fee9-4726-8de7-cacfb6b0cd3a
Service: sageway — 582ef6ed-7671-41d5-8794-cd7c89fa58f9
Custom domain: assigned CNAME target mlm2i6ky.up.railway.app
Working default domain: → 200

Symptoms — green DNS check + port 8080 in UI; openssl s_client … -servername <custom domain> → no peer certificate available; `curl → connection reset (exit 35); ports 80/443 accept TCP; no ACME error surfaced anywhere.

DNS is correct (not the cause) — CNAME consistent across all major resolvers, _railway-verify TXT present, no conflicting records, DNSSEC valid (not bogus), no blocking CAA.

The desync — custom domain is absent from the active serviceDomains config (only the .up.railway.app domain is listed) despite showing green and routing in the dashboard — a staged/partial state where issuance never fires. Possibly hit a Let's Encrypt failed-validation rate-limit backoff.

Already tried (no help) — (1) remove + re-add; (2) full redeploy 036aa275-3957-4e1b-b04d-e09d56f024f9 (SUCCESS).

Ask — Force/repair cert issuance for this domain (clear stuck state + re-commit to active config), or tell us the cert subsystem's state / any rate-limit backoff to wait out. We've stopped removing/re-adding to avoid compounding backoff.

Solved$10 Bounty