Hi Railway team,

I’m trying to attach a custom domain to a Railway service, but TLS certificate issuance keeps failing and seems stuck on validation.

Setup

• Platform: Railway
• Service: FastAPI backend
• Runtime: Python 3.12
• Region: us-west2
• Port: 8080 (Railway-detected, working)
• Public Railway domain works correctly:

https://closeready-backend-production.up.railway.app  

Custom domain

• Domain: api.closeready.ca
• DNS provider & registrar: Cloudflare
• DNS record:

Type: CNAME  
Name: api  
Target: 6tanr2cf.up.railway.app  
Proxy: DNS only (gray cloud)  
TTL: Auto  

• No other A / AAAA records for api.closeready.ca

Current behavior

• Railway shows:

Certificate Authority is validating challenges

• After retry:

Failed to issue TLS certificate – An internal error occurred

• Clicking Try Again does not resolve it
• Deleting and re-adding the domain does not help
• Waited 10+ minutes multiple times

DNS verification

From multiple resolvers:

nslookup api.closeready.ca
→ resolves successfully

Notes

• The service itself is healthy and reachable via the Railway-generated domain
• This appears to be isolated to TLS issuance / ACME validation
• No Cloudflare proxy or HTTPS redirect is enabled for this subdomain

Could you please help check whether there is an issue with certificate issuance on Railway’s side for this domain?

Thanks in advance!