Let's Encrypt cert provisioning stuck for custom domain
rivr-club
PROOP

10 days ago

i Railway team,

Custom domain cert provisioning has been stuck for ~90

minutes despite DNS being correctly propagated. Could you

check the Let's Encrypt queue / response for this domain?

I'll share the exact hostname + account by DM — the IDs below

let you find the case in your backend.

Identifiers

Account: (shared via DM)

Workspace: (shared via DM)

Project: (shared via DM) —

6d82c3d4-57a4-4624-9d88-b818624e04a2

Environment: staging (7790a2aa-c1e4-4762-b775-95faebb14ff8)

Service: api (a9e3b868-9329-4cf1-8326-d653e528e589)

Custom domain: (shared via DM) —

f4820f2e-f44a-47c9-8397-525b68f37d1a

Created at: 2026-05-12T20:23:43Z

State

DNS CNAME on my custom subdomain → 6cjrahw2.up.railway.app

(DNS-only via Cloudflare, no proxy)

Railway view: dnsRecords[0].status =

DNS_RECORD_STATUS_PROPAGATED, currentValue == requiredValue

certificates: [] (empty array)

No CAA record on the apex domain (any CA allowed)

HTTP/80 → 301 redirect, server: railway-edge (routing layer

recognizes the host)

HTTPS/443 → "Application not found" with x-railway-fallback:

true (TLS terminates against the *.up.railway.app wildcard

because no cert was ever issued for the custom domain)

Earlier I created an initial customDomain

(631e7658-2afb-4a1b-a3a2-41366e348350), waited ~25 min

without cert issuance, then deleted+recreated as f4820f2e to

retry. Could the recreate have triggered an LE rate-limit

backoff?

I also found this thread with the same symptoms, still

under_review: https://station.railway.com/feedback/custom-dom

ain-sit-banbunchee-co-th-is-st-a22d94f4

Thanks

Solved$20 Bounty

Pinned Solution

It looks like you need to add the TXT record. You can get the content from the verificationToken property under status through the API.

2 Replies

Railway
BOT

10 days ago

This thread has been marked as public for community involvement, as it does not contain any sensitive or personal information. Any further activity in this thread will be visible to everyone.

Status changed to Open Railway 10 days ago


It looks like you need to add the TXT record. You can get the content from the verificationToken property under status through the API.


Status changed to Solved brody 10 days ago


0x5b62656e5d

It looks like you need to add the TXT record. You can get the content from the `verificationToken` property under `status` through the API.

rivr-club
PROOP

10 days ago

Resolved — was missing the _railway-verify. TXT record from customDomain.status.verificationToken. The CNAME-only setup left the cert stuck in CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP indefinitely with certificates: [], while DNS records showed PROPAGATED and the routing layer recognized the host. Adding the TXT record flipped verified: true and the cert issued within ~5 minutes. Thanks!


Status changed to Awaiting Railway Response Railway 10 days ago


Status changed to Solved Railway 10 days ago


Welcome!

Sign in to your Railway account to join the conversation.

Loading...