Hi Railway team,

I have a custom domain that's stuck in a state where DNS is fully propagated and matches the required CNAME target, but no Let's Encrypt certificate is being issued. I've exhausted all the standard remediation steps documented in your community threads and would like an operator-side nudge or diagnosis.

Project: CMS FrontEnd

Project ID: 19661c0b-5c42-4dbd-9776-c36683c25e36

Environment: production (096cd382-474a-4a6d-8a4c-2aa7fc193290)

Service: openi-hub-cms (13171430-94cf-4887-9afc-34321ded88bc)

Custom domain ID: 9ed5bc03-8613-4d26-8c4c-c3d4c63ad2a9

Domain: admin.openi.tech

Current GraphQL state:

{

"domain": "admin.openi.tech",

"status": {

"dnsRecords": [{

"hostlabel": "admin",

"currentValue": "zve5xw5u.up.railway.app",

"requiredValue": "zve5xw5u.up.railway.app",

"status": "DNS_RECORD_STATUS_PROPAGATED"

}],

"cdnProvider": null,

"certificates": []

}

}

Verified externally:

$ dig +short admin.openi.tech CNAME

zve5xw5u.up.railway.app.

$ dig @ns53.domaincontrol.com +short admin.openi.tech CNAME

zve5xw5u.up.railway.app.

$ curl -I https://admin.openi.tech

curl: (35) error:0A000172:SSL routines::ssl/tls alert handshake failure

What I've already tried (with timestamps in UTC):

1. Initial custom-domain creation — DNS propagated within ~10 min, but certificates: [] persisted for 4+ hours

2. customDomainDelete + customDomainCreate via GraphQL (delete+re-add #1) — Railway re-assigned the CNAME target; updated GoDaddy DNS; certificate still didn't issue

3. customDomainUpdate to change targetPort (nudge attempt) — no effect

4. customDomainDelete + customDomainCreate (delete+re-add #2) — current state with target zve5xw5u.up.railway.app

5. Patient wait of 2+ hours with automated polling at 90s intervals (80 polls total) — DNS matched the entire time, certificates: [] throughout

6. Overnight wait (~6 hours additional) — no change

7. No CDN/proxy in front of the domain (cdnProvider: null), no CAA records blocking Let's Encrypt issuance

The two other custom domains in our org (api.openi.tech and app.openi.tech, in different projects) issued certificates within minutes of DNS propagation, so this appears specific to this domain or this service.

Could you please:

- Manually trigger Let's Encrypt issuance for this custom domain, or

- Investigate why automated issuance isn't kicking off despite DNS being correct

This is blocking our 5 May 2026 production cutover from the legacy admin.openi.ai domain. Happy to provide any additional logs or diagnostics on request.

Thanks,

Rajeev