Hi Railway team,

Certificate issuance never triggers for a custom domain, even after a clean

re-creation, while DNS is verified as propagated by your own dashboard/API.

Project: dashboard-v2-api (id 721bc48e-777d-4223-85f2-3d2be41b899b)

Environment: production (id 9b50dd27-641e-4d0c-872f-dc77da343b98)

Service: dashboard-v2-api (id d08be829-c866-4b82-a0f5-dd3c7607eb64)

Custom domain: bio.trainingperf.fr (current domain id d9b7cf19-8225-4d21-bed3-4570c9ba4cb5)

Symptoms:

• domains query returns DNS_RECORD_STATUS_PROPAGATED with

  currentValue == requiredValue (2lndmtrt.up.railway.app)

• status.certificates stays empty (checked over 12+ hours)

• the edge answers TLS with the *.up.railway.app wildcard cert, so the

  domain fails with SNI mismatch (curl: SSL: no alternative certificate

  subject name matches target host name)

Timeline:

• 2026-07-04: domain first added (mistakenly attached to another service of

  the same project which has no public HTTP - our mistake, since removed)

• 2026-07-09 ~13:40 UTC: deleted, re-created on the correct service, CNAME

  updated at the registrar within minutes. No certificate after ~7h.

• 2026-07-09 ~21:00 UTC: deleted + re-created again (current id above),

  CNAME switched within 1 minute (TTL 60). DNS propagated. Still no

  certificate 12h+ later.

Checks already done on our side:

• No CAA record on trainingperf.fr (any CA allowed)

• crt.sh shows no certificate was EVER issued for bio.trainingperf.fr

• The railway-provided domain dashboard-v2-api-production.up.railway.app

  serves HTTPS fine

• targetPort config identical to the working service domain (null)

Could you check why certificate issuance never starts/completes for this

domain in your pipeline, and unblock it? Happy to delete/re-add once more

if needed.

Thanks!