Domain: concierge.osintail.com

Custom domain ID (current instance): 2d5d9a76-f5f1-422c-974d-8767bd8d7b25

Problem: Adding the custom domain concierge.osintail.com never completes SSL issuance. certificateStatus has been stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for ~3 hours and the domain serves the fallback *.up.railway.app cert (SNI mismatch), so it's unreachable over HTTPS.

What I've verified is correct on my side:

• DNS is a DNS-only (unproxied) CNAME. Railway's own status shows requiredValue == currentValue == c909uowr.up.railway.app with DNS_RECORD_STATUS_PROPAGATED, so Railway sees the correct target.
• No CAA records on osintail.com (any CA, incl. Let's Encrypt, is permitted).
• The ACME HTTP-01 challenge path is reachable: http://concierge.osintail.com/.well-known/acme-challenge/ returns 404 for an unknown token (Railway is serving that path, not redirecting to HTTPS).
• Control: the same service already serves www.osintail.com and osintail.com with valid Railway-issued Let's Encrypt certs (e.g. origin presents CN=www.osintail.com). So routing and cert issuance work for this service — the failure is specific to concierge.osintail.com.

What I've tried:

• Deleted and recreated the custom domain three times over ~3 hours. Each recreate assigned a fresh CNAME target (6en4i8ls → dt5bn4w5 → c909uowr), and I updated DNS to match each within a minute. All three stalled identically in VALIDATING_OWNERSHIP and never issued.
• Waited >1 hour between attempts to rule out a Let's Encrypt failed-validation rate limit — it still fails immediately on a fresh instance.

Please investigate why ownership validation / cert issuance for this custom domain is stuck, and manually trigger issuance if there's a wedged state on your side. Happy to provide anything else.