Custom domains stuck serving default wildcard cert (x-railway-fallback 404) despite ACTIVE sync status — public API mutation is a no-op

Project: dazs-barber

Project ID: 32ce5161-950a-43c2-9a21-c98b51571d00

Environment: production (ce147e69-89b0-4469-8899-1201f3270ec7)

Two custom domains are stuck in this state:

1. chat.dazsbarber.com (custom domain id: 84ae247d-2f7e-4ea8-bdfb-45cee4a2a2a2)

   → service: chatwoot-web (e0ef99a8-29ae-410b-bee5-2a74c706b477), target port 3000

2. n8n.dazsbarber.com (custom domain id: 7cfccb9f-c58c-47fc-90f8-e528bfbda120)

   → service: n8n (347cc500-4537-4f82-8d44-171dd431ba33), target port 5678

Both domains show in the API as fully configured and healthy: syncStatus ACTIVE, edgeId assigned, DNS record DNS_RECORD_STATUS_PROPAGATED with currentValue matching requiredValue exactly, and correct targetPort.

Both backend services are confirmed healthy — verified directly on their Railway-provided service domains with real 200 responses:

• https://chatwoot-web-production-8df8.up.railway.app → 200, Chatwoot UI
• https://n8n-production-20008.up.railway.app → 200, n8n editor UI

But the custom domains return a fallback 404 on every request:

HTTP/2 404

server: railway-hikari

x-railway-fallback: true

{"status":"error","code":404,"message":"Application not found"}

Traced to the TLS layer. Each custom domain resolves to its own dedicated edge IP (not the shared pool): chat.dazsbarber.com → 69.46.46.66, n8n.dazsbarber.com → 69.46.46.87. Connecting directly with the correct SNI, the certificate served is NOT domain-specific — it's the generic wildcard:

$ curl -v https://chat.dazsbarber.com/

• subject: CN=*.up.railway.app
• issuer: C=US; O=Let's Encrypt; CN=YE1

< HTTP/2 404

< x-railway-fallback: true

                                                                                                                                                                           Ruled out on our side: DNS is a single clean CNAME resolving exactly to Railirmed via system resolver + 8.8.8.8); not proxied through Cloudflare(grey-cloud, resolves straight to Railway IPs); no CAA record restricting issuance; no pending TXT ownership verification.                                                     

Called the public customDomainIssueCertificate mutation for both domains multiple times over ~20 minutes. Confirmed it's a no-op: customDomain.updatedAt did not change at all between calls (2026-09-12T02:55:24.883Z before and after). No lever left on nual re-trigger of cert issuance / edge route installation for these twodomains.

Could you manually re-trigger this? Happy to provide more logs/diagnostics.