a month ago
Hi Railway Support,
We are experiencing intermittent Cloudflare 525 “SSL handshake failed” errors on our Railway service.
Project ID:
45821618-73cc-436f-94b8-a16905e6aa65
Service:
aigoal-ops
Service ID:
1aa23c29-8176-4971-9dde-8773af31de30
Environment:
production
Custom domains:
- app.aigoal.ai
- *.aigoal.ai
Railway service domain:
aigoal-ops-production.up.railway.app
Deployment region:
SFO / us-west2
Current deployment:
18260fae-5d42-4dcb-9b84-62662645016b
Observed error:
Cloudflare Error 525 — SSL handshake failed
Example timestamp:
2026-07-22 15:37:17 UTC
The issue is intermittent. Direct requests to the Railway service domain are stable:
https://aigoal-ops-production.up.railway.app/healthz
30/30 direct requests returned HTTP 200.
However, requests to the Cloudflare-proxied custom domain occasionally fail or time out:
Most requests return HTTP 200, but occasional requests receive no response and Cloudflare displays Error 525.
Additional information:
- Cloudflare SSL mode is Full.
- Railway deployment is running normally.
- Railway application logs show no corresponding 5xx errors.
- The health check path is /healthz.
- The service currently has one replica.
- The issue appears to happen before the request reaches the application.
Additional evidence:
I checked the certificates directly from the Railway origin.
With SNI app.aigoal.ai, Railway serves a valid Let's Encrypt certificate:
CN=app.aigoal.ai
Valid: Jun 14, 2026 - Sep 12, 2026
With SNI test-525-check.aigoal.ai, Railway serves a valid wildcard certificate:
CN=*.aigoal.ai
Valid: Jul 21, 2026 - Oct 19, 2026
This suggests the certificates are provisioned correctly.
The issue is intermittent:
- Direct Railway origin /healthz: 30/30 HTTP 200
- app.aigoal.ai: occasional timeout / Cloudflare 525
- Railway application logs show no corresponding 5xx
Please investigate the Cloudflare-to-Railway edge connection, connection reuse, and edge routing for this service around:
2026-07-22 15:37:17 UTC
Could you please investigate:
- Railway edge TLS handshake logs around 2026-07-22 15:37:17 UTC.
- The custom-domain routing and certificate status for app.aigoal.ai.
- Whether the Railway edge or origin IP pool has intermittent TLS/network failures.
- Whether one replica or the current SFO deployment could contribute to this issue.
- Any recommended configuration change or mitigation.
We can provide additional curl results and screenshots if needed.
Thank you.
4 Replies
a month ago
Having looked into this, the issue appears to be in your application code or configuration rather than the Railway platform itself, which puts it outside what Railway support can resolve directly.
This is exactly the kind of problem the Railway community is good at, so we'd like to open your thread as a community bounty. Railway pays a bounty to the community member who solves it, and threads like this usually get picked up quickly.
Opening it makes this entire thread public, including everything already posted. Nothing becomes public until you decide. Use the buttons below.
- Open to the community - Before you click, take a moment to edit or remove anything you'd rather not share. The thread becomes publicly visible right away.
- Keep it private and close the thread - Nothing becomes public. The thread closes, since this isn't something Railway support can take further.
Status changed to Awaiting User Response Railway • 30 days ago
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • 30 days ago
a month ago
Is your SSL set to Full or Full (Strict) in your Cloudflare dashboard?
0x5b62656e5d
Is your SSL set to Full or Full (Strict) in your Cloudflare dashboard?
a month ago
Full
Railway
Having looked into this, the issue appears to be in your application code or configuration rather than the Railway platform itself, which puts it outside what Railway support can resolve directly. This is exactly the kind of problem the Railway community is good at, so we'd like to open your thread as a community [bounty](https://docs.railway.com/community/bounties). Railway pays a bounty to the community member who solves it, and threads like this usually get picked up quickly. **Opening it makes this entire thread public**, including everything already posted. Nothing becomes public until you decide. Use the buttons below. - **Open to the community** - Before you click, take a moment to edit or remove anything you'd rather not share. The thread becomes publicly visible right away. - **Keep it private and close the thread** - Nothing becomes public. The thread closes, since this isn't something Railway support can take further.
a month ago
until now it is not solved