Custom domain validation stuck SSL certificate not issued

drislamuddin12-spec

FREEOP

a month ago

Subject: Custom domain stuck on "Validating domain ownership"

Hello Railway Team,

My custom domain aimrps.com has been stuck on "Validating domain ownership" for the last 7–8 days.

My DNS configuration is:

A record: aimrps.com → 66.33.22.237

CNAME: www → aimrps-production.up.railway.app

TXT: _railway-verify is present.

My application is working correctly at:

https://aimrps-production.up.railway.app

However, https://aimrps.com shows NET::ERR_CERT_COMMON_NAME_INVALID, and the custom domain remains stuck on "Validating domain ownership".

Could you please check my project and reset or re-trigger the domain validation and SSL certificate issuance?

Thank you.

$10 Bounty

1 Replies

Railway

BOT

a month ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway • about 1 month ago

jws

PRO

a month ago

I checked the public DNS/cert state.

The TXT verification record exists:

_railway-verify.aimrps.com TXT railway-verify=...

But the apex is configured as:

aimrps.com A 66.33.22.237

Railway’s current custom domain docs say the custom domain must use the exact CNAME value shown in the dashboard, plus the TXT record. For root/apex domains, Railway supports CNAME flattening or dynamic ALIAS/ANAME records. A hardcoded A record to a Railway edge IP can reach Railway, but it may not satisfy Railway’s domain validation/certificate issuance flow.

Also, the live www record currently resolves to:

www.aimrps.com CNAME 0fs42krb.up.railway.app

not aimrps-production.up.railway.app as stated in the report, so that should be checked against the exact value Railway shows.

Recommended fix:

In Railway, delete and re-add the custom domain aimrps.com.
Copy the exact CNAME target and TXT value Railway shows.
At the DNS provider, replace the apex A record with one of:
- CNAME flattening at @ to the Railway target, or
- ALIAS/ANAME at @ to the Railway target, or
- move DNS to Cloudflare and use a flattened CNAME at @.
Keep the _railway-verify TXT exactly as shown.
If www.aimrps.com should also work over HTTPS, add www.aimrps.com as its own Railway custom domain or redirect it at the DNS/provider level. It will not get a valid www.aimrps.com certificate just by CNAMEing to a Railway app domain unless Railway has that custom domain registered too.

After DNS matches the exact Railway-provided target, cert issuance should happen automatically. If it is still stuck after that and 72 hours have passed, then Railway should reset/retrigger validation.

Welcome!