7 days ago
I'm having this error and need to upload a website. Can anyone help me? The domain is hosted on LocalWeb and has already been configured correctly.
Attachments
2 Replies
7 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 7 days ago
7 days ago
This usually happens when the automated certificate authority (usually Let's Encrypt) cannot verify domain ownership via an HTTP-01 challenge. Even if the DNS is configured correctly on Locaweb's end, a few subtle issues can block the provisioning process.
Here is what you can do:
- Even if you've set the records correctly in Locaweb, DNS propagation isn't instant and can take anywhere from a few minutes to a few hours. If Railway's servers (or Let's Encrypt) query the DNS and get the old cache, the TLS challenge will fail.
What to do: Use a tool like DNS Checker or run dig www.sjbexpress.com.br CNAME in your terminal to verify that the domain is globally resolving to your Railway target (e.g., sjbb-production.up.railway.app).
- Sometimes, legacy DNS records conflict with the new setup. Let's Encrypt prefers IPv6 (AAAA records). If you have an old AAAA record pointing to a previous host, Let's Encrypt will try to reach that IPv6 address, fail, and abort the certificate issuance, entirely ignoring your correct CNAME or A record.
What to do: Check your Locaweb DNS zone. Ensure there are no A or AAAA records specifically for the www subdomain if you are using a CNAME for it.
- A Certificate Authority Authorization (CAA) record dictates which authorities are allowed to issue certificates for your domain. If Locaweb or a previous setup generated a CAA record restricting issuance to another provider, Railway's request will be blocked.
What to do: Look for any CAA records in your Locaweb dashboard. If they exist, either remove them or ensure there is an entry allowing letsencrypt.org.
- If you have any proxy layer sitting between Locaweb and Railway (such as Cloudflare) configured to proxy the traffic, it intercepts the HTTP challenge Let's Encrypt uses to verify the domain.
What to do: If a proxy is active, temporarily disable the proxy status (set it to "DNS-Only") until Railway successfully issues the certificate, then you can turn it back on.
7 days ago
If the certificate isn't issued within a day, I suggest you remove your domain and all its related DNS records, wait 10 ~ 15 minutes, then add it again. This usually fixes the problem.