Custom domain stuck on wildcard cert — Let's Encrypt issuance not completing for api.scoutyx.com

Question

Project:     scoutyx-production   (fe4a014d-16c2-4ea7-b199-e71791026819)

Environment: production           (62e5766c-d07c-448d-93a2-e99524c43303)

Service:     scoutyx              (22b55a55-6b18-4650-a379-8b56a5e00ea4)

Custom domain:            api.scoutyx.com          — stuck

Railway-generated domain: scoutyx-production.up.railway.app — works, correct cert

PROBLEM

api.scoutyx.com is served with CN=*.up.railway.app instead of a certificate for

the hostname, so TLS fails for every client:

* subject: CN=*.up.railway.app
  * subjectAltName does not match host name api.scoutyx.com
  * SSL: no alternative certificate subject name matches target host name

TIMELINE (2026-07-30, all times UTC+2)

~12:00  Custom domain added, CNAME created immediately

~18:00  Still wildcard. Removed and re-added the domain to force a retry

~23:30  Still wildcard, ~11h after first add and ~5h after the retry

DNS — verified against 8.8.8.8 and 1.1.1.1

api.scoutyx.com  CNAME  c8cw6ikt.up.railway.app  (-> 69.46.46.88)

- Exactly one record. No conflicting A record, no TXT, no CAA.

(`dig api.scoutyx.com CAA +noall +answer` returns only the CNAME.)

- No CAA on scoutyx.com or on .com, so Let's Encrypt is not restricted.
  - Nameservers: dns1/dns2.registrar-servers.com (Namecheap BasicDNS).

No Cloudflare, no proxy of any kind in front.

- DNSSEC not enabled (no DS record).

CONNECTIVITY

- The ACME HTTP-01 path is routable and reaches Railway's edge:

http://api.scoutyx.com/.well-known/acme-challenge/test  ->  404 (from Railway)

- The service is healthy; /api/health returns 200 over the Railway domain.

STATUS PAGE

Checked. The only incident today (builds/deployments delayed, OA5Z6SQY) was

resolved at 17:59 UTC and does not cover TLS or custom domains.

WHAT I'M ASKING

Every cause documented in https://docs.railway.com/networking/troubleshooting/ssl

is ruled out on my side, so this looks like it is stuck in Railway's

provisioning layer. Could you check:

1. Whether an ACME order was ever submitted for api.scoutyx.com
    2. Whether a challenge was attempted and what it returned
    3. Any internal error or rate limit blocking issuance for this domain

I have deliberately NOT removed and re-added again, to stay well inside the

Let's Encrypt duplicate-certificate limit (5 per domain per week — currently 2).

IMPACT

This host is baked into an iOS binary that is queued for TestFlight Beta App

Review. Until the certificate issues, the app cannot reach its API.