2 days ago
Hello,
Our custom domain has been stuck in certificate issuance for 14 days and never
becomes verified. This looks identical to the thread "Custom domain stuck at
ISSUING / Verified no despite correct DNS" (solved 2 days ago by sam-a).
Project: agile-art (09dfcd32-ad52-4ce2-945d-fc1a48240c42)
Environment: production (3e4ed673-69df-4f18-8897-d584ffed0e89)
Service: HabitationsLeblanc (9ab46ee8-08b3-42d6-a208-edd227b68c0b)
Domain: app.habitationsleblanc.ca (16ea0fc1-ec89-44a2-95c5-c450923c99e4)
Current state (railway domain status):
Sync status: ACTIVE
Verified: no
Certificate status: CERTIFICATE_STATUS_TYPE_ISSUING
Created: 2026-08-17T16:13:16Z
Updated: 2026-08-17T16:13:16Z <-- never updated since creation
DNS is correct and publicly resolvable. Verified from outside our network via
Google Public DNS, with answers served by the authoritative nameserver
ns1.legardeur.net:
CNAME app.habitationsleblanc.ca
-> 6tnebth2.up.railway.app
(your dashboard shows a GREEN CHECK on this record)TXT _railway-verify.app.habitationsleblanc.ca
-> railway-verify=a670a7ae61b6e2deb037f0c67558943af078be992aa97c6f1939ca69309ffcc4
(exact match to the value your dashboard displays, yet the dashboard
shows a WARNING icon on this record)CAA none on habitationsleblanc.ca — nothing blocking Let's Encrypt
DNSSEC not enabled
Likely cause: the domain was created on 2026-08-17, but the DNS zone was only
updated on 2026-08-20 (zone serial 2026082001), three days later. The initial
verification failed and has apparently never been retried since — the "Updated"
timestamp has not moved in 14 days.
We tried the CLI retry:
railway domain certificate retry app.habitationsleblanc.ca --service HabitationsLeblanc
which refuses with:
"Certificate retry is only available after certificate issuance fails.
Current status: CERTIFICATE_STATUS_TYPE_ISSUING."
Observed edge behaviour: https://app.habitationsleblanc.ca presents the
*.up.railway.app certificate, so browsers fail with ERR_CERT_COMMON_NAME_INVALID.
With certificate checks disabled, the edge returns
{"status":"error","code":404,"message":"Application not found"}.
The service itself is healthy at https://habitationsleblanc-production.up.railway.app
(/api/v1/health returns 200).
2 Replies
Status changed to Awaiting Railway Response Railway • 1 day ago
2 days ago
Your DNS records are correct and the verification TXT value matches, but the domain is stuck with verified: false and the certificate at CERTIFICATE_STATUS_TYPE_ISSUING. We have started a certificate re-issuance for app.habitationsleblanc.ca, which may take a few minutes to complete.
Status changed to Awaiting User Response sam-a • 1 day ago
11 hours ago
Hello Sam,
Confirming the re-issuance worked: the certificate is now valid and
app.habitationsleblanc.ca serves our application correctly. Verified on
2026-09-01 from multiple networks, including mobile data.
Thank you for the manual re-issuance. One note for your team: the root
cause on our side was that the DNS records were added three days after
the domain was created in Railway, and the failed initial verification
was never retried automatically — the domain stayed at ISSUING for 14
days with no way for us to retry it ("certificate retry" is refused
while the status is ISSUING). An automatic periodic retry, or allowing
the CLI retry in that state, would have avoided this ticket entirely.
You can close the ticket. Thanks again!
Status changed to Awaiting Railway Response Railway • about 11 hours ago
Status changed to Solved Railway • about 11 hours ago