4 days ago
SSL certificate issuance appears wedged for six custom domains across three projects. All DNS is propagated (confirmed by your dashboard/API status = PROPAGATED and externally via Google DoH), yet certificateStatus has remained VALIDATING_OWNERSHIP for 5+ hours. The edges are serving the default *.up.railway.app certificate for these SNI hosts (browsers show ERR_CERT_COMMON_NAME_INVALID).
Domains / services:
- Project vantail (8f0249de-ab62-4c74-b245-9a8bb6375f32), service vantail (c278cda7-6445-4cc3-adb8-325ee1c9e6e3), env production: vantail.net (ALIAS @ -> tig4eqh5.up.railway.app, PROPAGATED) and www.vantail.net (CNAME -> cti5vb3e.up.railway.app, PROPAGATED).
- Project neshira-site (755144e8-1db1-4dc1-9bb5-c8d70e42e53f), service neshira-site, env production: neshira.net (ALIAS @ -> t1cpb1nb.up.railway.app, PROPAGATED) and www.neshira.net (CNAME -> w9po503l.up.railway.app, PROPAGATED).
- Project age-pilot-academy (7e2d9bd8-3bf3-4897-ae66-71a36c7d49a1), service age-pilot-academy (e204e94f-7d29-4fb9-806d-ebbe5fd2306e), env production (1e783e3b-8db8-4495-a9ad-bd66e7f959e1): agepilot.academy (ALIAS @ -> zy84ctcg.up.railway.app, PROPAGATED, resolves to your edge 69.46.46.94 via DoH) and www.agepilot.academy (CNAME -> c3t48wxt.up.railway.app, PROPAGATED, currentValue matches requiredValue in your API). TIME-SENSITIVE: a student cohort starts Monday July 6 on this domain.
Already verified on our side: DNS resolves globally to your edges (69.46.46.x) via dns.google DoH; no CAA records on any domain; DNSSEC not enabled; plain HTTP reaches your edge and returns your 301 to HTTPS; the edge presents CN=*.up.railway.app (no per-domain cert); all services deployed and healthy on their railway.app domains.
Context that may matter: vantail/neshira domains were attached earlier today, sat about an hour with mismatched DNS (our error, corrected), then deleted + re-attached once. agepilot.academy pointed at a parking IP from ~Jun 28 until corrected ~17:05 UTC today - failed ACME attempts from those windows may have triggered Let's Encrypt backoff. We have deliberately NOT delete/re-added again per your docs' rate-limit warning.
Ask: please re-trigger certificate issuance for the six domains above, or advise what is blocking validation. Account: anderson.omar@andersonglobalenterprises.net (Omar Anderson's Projects).
1 Replies
4 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 4 days ago
4 days ago
You need to add a TXT record for _railway-verify.www.vantail.net. If you are using the API to add your custom domain, you can find it in verificationToken under status. Add the TXT records to the rest of your domains (_railway-verify.<DOMAIN>)