a month ago
Hi Railway team,
A custom domain on my Pro project has been stuck in "Validating ownership" for 2+ hours and the TLS certificate is not issuing. The edge is serving the default *.up.railway.app wildcard cert, so browsers get a hostname mismatch (NET::ERR_CERT_COMMON_NAME_INVALID).
Details:
- Project: change-tracker-production (ID 0bc8040b-3c96-4687-b174-b3c79d753ab7)
- Environment: production
- Service: ct-web
- Custom domain: change-tracker.agilitychanges.com
- Railway target: vtqxa64a.up.railway.app
What I've verified myself:
- DNS is correct and fully propagated: CNAME change-tracker.agilitychanges.com -> vtqxa64a.up.railway.app (confirmed on the GoDaddy authoritative nameservers, Google 8.8.8.8, and Cloudflare 1.1.1.1). Railway's domain panel also shows the record as PROPAGATED.
- No CAA record blocks Let's Encrypt.
- HTTP reaches the Railway edge (curl returns 301 from 69.46.46.119).
- HTTPS handshake returns subject CN=*.up.railway.app with "subjectAltName does not match" for change-tracker.agilitychanges.com — i.e. no certificate has been issued for the custom domain.
- Cert status via API: CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP.
- I already removed and re-added the custom domain once, with no change.
Could you please trigger / unblock ACME certificate issuance for this domain? I see there is an active incident (GitHub outage affecting builds, 8BVRVAAM) — if cert issuance is impacted by the same incident, please let me know and I'll wait it out.
Thank you.
Pinned Solution
a month ago
You need to add a TXT record for _railway-verify.change-tracker.agilitychanges.com. If you are using the API to add your custom domain, you can find it in verificationToken under status.
2 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
You need to add a TXT record for _railway-verify.change-tracker.agilitychanges.com. If you are using the API to add your custom domain, you can find it in verificationToken under status.
darseen
You need to add a TXT record for `_railway-verify.change-tracker.agilitychanges.com`. If you are using the API to add your custom domain, you can find it in `verificationToken` under `status`.
a month ago
Thank you so much, darseen — really appreciate you jumping in to help! 🙏 The certificate has since been issued: the domain now serves a valid Let's Encrypt cert over HTTPS (verification OK, HTTP/2 200). Marking this as resolved. Thanks again!
Status changed to Solved 0x5b62656e5d • about 1 month ago