This cannot be solved by the community — it is a Railway-side edge TLS

certificate provisioning failure that only Railway staff/infra can fix.

Please route this to the Railway team. This is production-down.

Alternatively I will re-open as "Ask Railway Privately".

Project: hearty-contentment / production (Southeast Asia)

Railway is failing to issue SSL/TLS certificates for our custom domains. This is

production-impacting and started after the July 13 HA Static IP / Metal migration.

Details:

• New custom domain lk.rocketmetrix.ru: added via "+ Custom Domain". DNS is fully

  correct — CNAME lk -> pdfftih7.up.railway.app and TXT _railway-verify.lk are both

  in place, and the domain shows a GREEN verified checkmark in the dashboard. Yet

  after 40+ minutes NO certificate has been issued. The edge (69.46.46.60) serves no

  certificate for this SNI, so browsers get an SSL error ("cannot establish a secure

  connection"). openssl s_client returns no peer certificate.

• Earlier today the exact same thing happened with app.rocketmetrix.ru — it never got

  a working certificate either, even after removing and re-adding the domain.

• Your generated domain jarviss.up.railway.app works perfectly (it uses the shared

  *.up.railway.app wildcard cert). ONLY our custom-domain certificates fail to provision.

• This matches other reports on Central Station of domains stuck on "Issuing TLS

  certificate" after the Metal migration.

Impact: our production site is unreachable for our customers, who are actively

complaining right now. We are in Russia and cannot load the site even via VPN, because

the certificate is simply not there to establish a secure connection.

Ask: please provision/issue the TLS certificates for lk.rocketmetrix.ru and

app.rocketmetrix.ru on your edge, or tell us exactly what is blocking issuance on your

side (rate limit? validation failure?).

Timeline: if this is not resolved within the next ~2 hours, we will be forced to

migrate off Railway to another provider — we cannot keep our customers waiting any

longer.

I'm able to load lk.rocketmetrix.ru. Try accessing the site from an incognito window or a different device.

Full summary of the issue and where we landed, for the record.

Project: hearty-contentment / production (region: Southeast Asia).

Symptom: our custom domains app.rocketmetrix.ru and www.rocketmetrix.ru

(and the apex rocketmetrix.ru) were completely unreachable from Russia —

across 3 computers and a phone, on both Wi-Fi and mobile, with and without

VPN. The Railway-generated domain jarviss.up.railway.app and a freshly

created subdomain lk.rocketmetrix.ru worked fine.

Diagnosis (verified with many controlled tests):

• The TLS ClientHello is dropped at the network level in Russia for the

  specific hostnames app/www/rocketmetrix.ru, regardless of destination IP.

  Same Cloudflare/Railway IP: SNI=lk.rocketmetrix.ru completes in <1s,

  SNI=app.rocketmetrix.ru times out at ~6-8s. Tested against Railway edges,

  Cloudflare IPs, and even unrelated Russian servers — same result. So it is

  Russia-side, name-based (SNI) filtering of those established hostnames, not

  a config/DNS/server issue on our side. The domain is clean on reputation

  blocklists (URLVoid 0 detections); it appears to be collateral filtering.

• Separately, Railway was not issuing TLS certificates for newly added custom

  domains (lk and re-added app both sat with green/verified DNS but no cert

  for 40+ min). This looks related to the Metal migration — matches other

  reports on Central Station of domains stuck on "Issuing TLS certificate".

What we tried, per your suggestion: moved the domain's nameservers to

Cloudflare and proxied the records (orange cloud). This removed the hard

block — app/www now load from Russia — BUT only intermittently. Russian ISPs

throttle parts of Cloudflare's IP ranges, so each request hits a random

Cloudflare IP and succeeds or fails at random. Heavy pages fail more often

(connection reset mid-transfer). So Cloudflare took us from "fully blocked"

to "flaky", but not to reliable.

Conclusion: the root cause is Russia-side blocking/throttling of foreign

hosting reachability for these hostnames, which is outside Railway's control.

For reliable access for our Russian customers we are migrating to a

Russia-based host (domestic IP, traffic stays in-country).

Two questions if you have any input:

1. Is the custom-domain TLS certificate issuance (stuck after the Metal

   migration) a known issue, and is there anything to unstick it?

2. Do you have any guidance for serving Russian end-users reliably from

   Railway, or is Cloudflare-in-front the only lever on your side?

Thanks for the help so far.

Railway's edge router doesnt have your SSL certificate loaded.

Go to your Railway dashboard, delete the custom domain, wait 2–3 minutes, and re-add it. You can also try using Cloudflare with a Custom SNI/Proxy Setup

Full status update.

Project: hearty-contentment / production (region: Southeast Asia).

The custom domains app.rocketmetrix.ru and www.rocketmetrix.ru are unreachable

for our users. What works and what doesn't:

• lk.rocketmetrix.ru → WORKS (verified earlier, serves a certificate, loads fine).
• jarviss.up.railway.app → WORKS.
• app.rocketmetrix.ru / www.rocketmetrix.ru → FAIL, even from outside Russia via VPN.

Everything is on the SAME service. The only difference is that lk was verified

BEFORE the certificate problem started, and app/www were re-added AFTER.

Following your earlier advice, I deleted and re-added app.rocketmetrix.ru and

www.rocketmetrix.ru, added the new CNAME targets (58edi119 / db3gl94q) and the

_railway-verify TXT records. Both domains now show GREEN / verified in Networking.

BUT the TLS certificate is still never issued for them:

• They fail even via VPN (from outside Russia) with an SSL / secure-connection

  error — so this is NOT a regional block, it is a missing certificate.

• openssl s_client to the new edge (69.46.46.106, SNI=app.rocketmetrix.ru) returns

  NO peer certificate.

• I also tried putting Cloudflare in front (Cloudflare's own cert): lk works through

  it, but app/www still fail to serve, consistent with the cert never provisioning

  on Railway's edge.

So: the edge router verifies the domain (green) but the certificate never

provisions. This matches the "certificate stuck after Metal migration" reports on

Central Station. Only the newly (re-)added custom domains are affected; lk (verified

earlier) is fine.

Please have your infrastructure team provision the TLS certificates for

app.rocketmetrix.ru and www.rocketmetrix.ru on the edge, or tell us exactly what is

blocking issuance (rate limit? a stuck ACME order for these hostnames?).

This is production and customers are affected. Thank you.

It might take a few hours maybe even a day for railway to verify domains and TLS certificate for your domain

Also I can access your site without VPN. Both domains are working just fine.

You might want to redeploy your service after these adjustments.