My custom domain has been stuck without a dedicated TLS certificate for over an hour, across two separate add attempts.

DNS is confirmed correct and fully propagated — the required CNAME target resolves correctly, verified both locally and via Google's public DNS-over-HTTPS resolver.

A direct TLS check (openssl s_client -connect :443 -servername ) shows Railway's generic wildcard cert (CN = *.up.railway.app) being served for this SNI instead of a dedicated one — SSL: no alternative certificate subject name matches target host name.

What I've tried:

1. Added the custom domain, given a CNAME target. Pointed DNS there via Cloudflare, propagated within ~15s. No cert after 30+ minutes.
2. Deleted and re-added the domain to force a fresh issuance attempt. Railway assigned a new CNAME target. Updated DNS to match, propagated within ~15s.
3. Railway's own domain-status check kept reporting the old CNAME as the current value for roughly another hour before finally catching up to match the required value.
4. Even after that, no certificate has issued.

This isn't a root-domain/CNAME-flattening issue — the domain in question is a subdomain, and DNS has been on Cloudflare nameservers the entire time, so the usual apex-domain workaround doesn't apply here.

Can someone check what's blocking certificate issuance, or manually trigger a re-issuance? Happy to share the exact domain/project details privately if that helps.