3 months ago
The TXT record for _railway-verify.tools for our subdomain tools.huvo.co.uk isn't being verified. Would you kindly confirm what the issue is?
Thanks, Tariq
3 Replies
Status changed to Awaiting Railway Response Railway • 3 months ago
3 months ago
Your CNAME and TXT verification records for tools.huvo.co.uk are both correctly configured and resolving publicly. The certificate is currently stuck at the ownership validation stage. Since your domain is on Cloudflare, please ensure your SSL/TLS encryption mode is set to "Full" (not "Full (Strict)") for this domain. Full Strict mode requires TLS to the origin, which breaks the HTTP-01 ACME challenge needed to issue your certificate, since the challenge must complete over an unencrypted channel first. You can find more detail here: https://letsencrypt.org/docs/challenge-types/#http-01-challenge
Also make sure Cloudflare's proxy (orange cloud) is enabled for the CNAME record, as this is generally required for Cloudflare-managed domains pointing to Railway. After adjusting the SSL mode, the certificate should provision and verification should complete.
Status changed to Awaiting User Response Railway • 3 months ago
chandrika
Your CNAME and TXT verification records for tools.huvo.co.uk are both correctly configured and resolving publicly. The certificate is currently stuck at the ownership validation stage. Since your domain is on Cloudflare, please ensure your SSL/TLS encryption mode is set to "Full" (not "Full (Strict)") for this domain. Full Strict mode requires TLS to the origin, which breaks the HTTP-01 ACME challenge needed to issue your certificate, since the challenge must complete over an unencrypted channel first. You can find more detail here: https://letsencrypt.org/docs/challenge-types/#http-01-challenge Also make sure Cloudflare's proxy (orange cloud) is enabled for the CNAME record, as this is generally required for Cloudflare-managed domains pointing to Railway. After adjusting the SSL mode, the certificate should provision and verification should complete.
3 months ago
We've now made that change in Cloudflare, are you able to trigger a validation?
Thanks, Tariq
Status changed to Awaiting Railway Response Railway • 3 months ago
3 months ago
This thread has been marked as public for community involvement, as it does not contain any sensitive or personal information. Any further activity in this thread will be visible to everyone.
Status changed to Open Railway • 3 months ago
a month ago
Since Railway already confirmed the CNAME and TXT records are resolving, this looks like the certificate/ownership-validation job is stuck rather than a DNS setup issue.
Before waiting on staff, I would check three things:
-
Cloudflare SSL/TLS mode is exactly Full, not Flexible or Full Strict. Railway documents this Cloudflare requirement here: https://docs.railway.com/networking/troubleshooting/ssl
-
The Railway CNAME and TXT verification records still match the values shown in the dashboard/CLI. Railway's domain docs note that TXT ownership verification is required before the domain is considered verified: https://docs.railway.com/networking/domains/working-with-domains
-
If both are correct and it has been stuck this long, remove the custom domain from the service and add it again once to trigger a fresh certificate issuance cycle. I would only do this once because Let's Encrypt has duplicate-certificate rate limits.
If it is still stuck after re-adding once and waiting about an hour, it likely needs Railway staff to clear or nudge the backend validation state for that domain.