10 days ago
My custom domain http://www.cliniqai.app has been stuck in VALIDATING_OWNERSHIP since 2026-08-10 and has never been issued a certificate. The edge serves the default *.up.railway.app certificate, which fails hard in browsers because .app is on the HSTS preload list — there is no click-through, so the domain is effectively dead rather than just warning.
This looks identical to the launcherry.me thread from a couple of days ago, which an employee resolved by re-triggering issuance server-side after the certificate pipeline stalled once verification had completed.
Current state
- certificate status: VALIDATING_OWNERSHIP
- certificateErrorType, certificateErrorMessage, certificateStatusDetailed and certificateRetryable are all null — no surfaced failure to act on
- The single required DNS record (CNAME on www) reports DNS_RECORD_STATUS_PROPAGATED, and requiredValue == currentValue. No TXT record is listed as required for this domain.
- The service itself is healthy and returns 200 on its *.up.railway.app domain.
Ruled out on my side
- CNAME is correct at the authoritative nameserver (GoDaddy)
- No CAA records on my zone, and none on up.railway.app
- DNSSEC is not enabled (no DS, no DNSKEY)
- ACME HTTP-01 path is reachable: http://www.cliniqai.app/.well-known/acme-challenge/ returns 404 and is NOT redirected, whereas / returns a 301 to HTTPS. So the edge is intercepting the challenge path correctly — but no challenge token is ever placed there.
Already tried
Re-triggered certificate issuance twice: once on the original domain record, and again after deleting and recreating the domain (which rotated the CNAME target — I updated DNS at the registrar and confirmed propagation at the authoritative nameserver before retrying). Both attempts reported success and neither produced a certificate.
Ask
Could an employee please re-queue certificate issuance for http://www.cliniqai.app? I would rather not keep deleting and recreating the domain, since repeated failed validations risk hitting Let's Encrypt rate limits for this hostname.
Happy to provide project / service / domain identifiers privately if that helps.
1 Replies
10 days ago
Your domain's CNAME is correctly propagated, but the TXT ownership-verification record is missing. Railway requires both a CNAME (for routing) and a TXT record (for ownership verification) before a certificate will issue, per our custom domain docs. You can find the exact TXT record name and value to add in your service's Settings under the custom domain entry for www.cliniqai.app. The record goes on the host _railway-verify.www in your cliniqai.app DNS zone. Once that propagates, verification should complete and the certificate will be issued automatically. Reply here after adding it and we can confirm the status.
Status changed to Awaiting User Response Railway • 10 days ago
Status changed to Solved evegarcianz • 9 days ago