a month ago
"My custom domain www.chatbooksai.com has been stuck with NET::ERR_CERT_COMMON_NAME_INVALID for 2+ days. DNS is fully propagated — CNAME points to v2z5q2f2.up.railway.app and TXT verification record is set. The certificate being served is still *.up.railway.app. This started during your recent CDN incident. Service ID: f0302b33-a089-4919-af5b-fb5a14a3a374. Please force re-issue the SSL certificate for this domain."
4 Replies
Status changed to Awaiting Railway Response Railway • about 2 months ago
Status changed to Open Railway • about 1 month ago
a month ago
I ran nslookup on _railway-verify.www.chatbooksai.com but I got NXDOMAIN for a TXT record. I'd try removing the TXT record from your DNS provider, waiting for ~10-15 mins, then readd them.
a month ago
Update with new findings:
Let's Encrypt already issued a valid certificate for www.chatbooksai.com on April 5, 2026 — verifiable on crt.sh. The cert is valid until July 4, 2026 and was issued by Let's Encrypt R13.
However, Railway's Fastly CDN edge (151.101.2.15) is still serving *.up.railway.app instead of the issued cert.
Current DNS state (all correct):
- CNAME: www.chatbooksai.com → v2z5q2f2.up.railway.app ✓
- TXT: _railway.chatbooksai.com → railway-verify=67a46c0455479c28af2adae1035d6d55c3325d3bcee86692b2ecfcb4328cd591 ✓
- DNSSEC: disabled ✓
- No conflicting records ✓
The cert EXISTS in your system but hasn't been pushed to the Fastly CDN edge. This appears to be a Railway-side CDN deployment issue, likely related to the recent CDN incident. Can a staff member force-push/redeploy the SSL cert to the edge for this domain?
Service ID: f0302b33-a089-4919-af5b-fb5a14a3a374
a month ago
try removing the domain wait 30 minutes then add it again
a month ago
Update: All DNS records now match Railway's requirements exactly (confirmed via "Show DNS records" in Railway settings):
- CNAME: www → v2z5q2f2.up.railway.app ✓ (propagated)
- TXT: _railway-verify.www → railway-verify=67a46c0455479c28af2adae1035d6d55c3325d3bcee86692b2ecfcb4328cd591 ✓ (propagated)
- DNSSEC: disabled ✓
Despite this, Railway still shows "Waiting for DNS update" and serves *.up.railway.app cert. Notably, Let's Encrypt already issued a valid cert for www.chatbooksai.com on April 5, 2026 (verifiable on crt.sh) — so the cert EXISTS but Railway's Fastly CDN edge is not serving it.
Also upgraded to Hobby plan. Lightning bolt clicked multiple times. Still stuck. This appears to be a backend issue on Railway's side. Can a staff member manually trigger domain verification or push the cert to the edge?