8 days ago
Apex custom domain certificate never issued, while the www sibling issued within minutes.
Project: studyless-site (production) · Service: wordpress
Domains: study-less.com (apex) and www.study-less.com
WHAT HAPPENED
-
Added both domains. www.study-less.com (target oguccu37.up.railway.app)
got a Let's Encrypt cert within ~5 minutes and works perfectly.
-
study-less.com (target pzspu3l7.up.railway.app) stayed on
"Certificate Authority is validating challenges" for 40+ minutes and never
issued — the edge kept serving the default *.up.railway.app certificate.
DNS WAS CORRECT DURING THAT TIME
-
Tried ANAME/ALIAS @ -> pzspu3l7.up.railway.app (provider supports ALIAS).
Verified propagation on all 12 authoritative nameservers and on public
resolvers 8.8.8.8 / 1.1.1.1 / 9.9.9.9 / 208.67.222.222 — all returned
69.46.46.34 consistently.
-
Then tried a plain A record @ -> 69.46.46.34 (to rule out ALIAS synthesis
inconsistency). Same result: 30 more minutes, no certificate.
-
TXT _railway-verify present and matching the dashboard value.
-
No CAA records at all (dig CAA study-less.com returns nothing).
-
DNSSEC disabled (no DNSKEY).
-
No Cloudflare — DNS is hosted at dnshosting.org, no proxy in front.
-
Account is on the Pro plan.
CURRENT STATE (important)
Because the apex had no valid certificate, visitors got SSL errors on the
main domain, so we had to point study-less.com back to our old host as a
temporary workaround. Right now:
- study-less.com -> old host (valid cert, 301 redirects to www)
- www.study-less.com -> Railway, working correctly
QUESTION
What blocked issuance for the apex specifically, when the identical setup on
www worked immediately? We would like to move the apex to Railway as well.
If you need DNS pointed back at Railway for you to force a retry, tell us and
we will schedule a maintenance window — but we cannot leave the main domain
without a valid certificate for another 40+ minutes of trial and error.
3 Replies
Status changed to Awaiting Railway Response Railway • 8 days ago
8 days ago
Good news first: nothing in your DNS was the blocker. No CAA records, DNSSEC off, no proxy in front, ownership verified on our side, and you had the apex resolving to our edge correctly. The www certificate issued normally on the same setup, so your configuration is sound.
What actually happened is that the apex certificate order got stuck partway through issuing on our end and never completed, while www's completed fine. It's still sitting in that stuck state now, and since you've pointed study-less.com back to your old host as a workaround, the order can't finish until the apex resolves to Railway again.
We don't want to put you through another round of trial and error. When you're ready, point study-less.com back at Railway (an ALIAS/ANAME to pzspu3l7.up.railway.app is best, so a future edge IP change won't break it) and reply here the moment it's live. We'll force the certificate re-issue right then rather than waiting on the automatic retry, so it should go valid within a couple of minutes like www did.
Status changed to Awaiting User Response Railway • 8 days ago
dizzydes90
Good news first: nothing in your DNS was the blocker. No CAA records, DNSSEC off, no proxy in front, ownership verified on our side, and you had the apex resolving to our edge correctly. The www certificate issued normally on the same setup, so your configuration is sound. What actually happened is that the apex certificate order got stuck partway through issuing on our end and never completed, while www's completed fine. It's still sitting in that stuck state now, and since you've pointed study-less.com back to your old host as a workaround, the order can't finish until the apex resolves to Railway again. We don't want to put you through another round of trial and error. When you're ready, point study-less.com back at Railway (an ALIAS/ANAME to pzspu3l7.up.railway.app is best, so a future edge IP change won't break it) and reply here the moment it's live. We'll force the certificate re-issue right then rather than waiting on the automatic retry, so it should go valid within a couple of minutes like www did.
8 days ago
DNS is live now — study-less.com resolves to Railway (69.46.46.34) via ANAME
to pzspu3l7.up.railway.app. Verified on the authoritative nameservers and on
8.8.8.8 / 1.1.1.1. The Webflow records are removed.
Please force the certificate re-issue for the apex. Thanks!
Status changed to Awaiting Railway Response Railway • 8 days ago
8 days ago
Done. The apex certificate for study-less.com is now issued and valid (Let's Encrypt, good through November 11), and the domain is serving over HTTPS from Railway with your 301 to www intact. We forced the re-issue on our side once your DNS was live, so you didn't have to wait on the automatic retry. You can confirm it in the Networking panel showing the domain as active. Thanks for scheduling the repoint, and let us know if anything looks off.
Status changed to Awaiting User Response Railway • 8 days ago
Status changed to Solved dizzydes90 • 8 days ago