Custom domain api.slabbed.us on my backend service has been stuck on certificate/ownership validation for an extended period and is not progressing.

Current status

domain-status returns:

verified: false

certificate.status: CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP

errorMessage: null

The domain still serves the default *.up.railway.app certificate, so requests to api.slabbed.us fail with SSL: no alternative certificate subject name matches target host name.

Project details

Project: vaultrip-staging

Environment: production

Service: backend

Domain: api.slabbed.us (targetPort 8080)

What I've already verified

Both required DNS records are correct and propagated, confirmed against three independent resolvers (system default, 1.1.1.1, 8.8.8.8) with identical results:

api.slabbed.us CNAME → mdcu82si.up.railway.app (matches the required value exactly; Railway's own DNS check reports DNS_RECORD_STATUS_PROPAGATED)

_railway-verify.api.slabbed.us TXT → matches the expected railway-verify=... value exactly

I also worked through the checks in your Troubleshooting SSL doc:

No CAA records on slabbed.us (nothing blocking Let's Encrypt)

No conflicting A record on api.slabbed.us

DNSSEC not enabled (no DNSKEY, no DS record) — not a factor

Not behind Cloudflare or any proxy

Service is deployed and healthy (responds 200 on /actuator/health via the .up.railway.app domain)

Question

Since DNS is confirmed correct on my end and ownership validation still isn't completing, could someone check the certificate issuer logs / internal validation state for this domain and either re-trigger validation or tell me what's blocking it?

Note: I did one delete/re-add of the domain earlier while troubleshooting, so I'm avoiding further re-adds to stay clear of Let's Encrypt duplicate-certificate rate limits.