a day ago
I found your Railway Central Station discussion about different Let's Encrypt certificate chains (RSA vs ECDSA):
https://station.railway.com/questions/different-let-s-encrypt-cert-chains-rsa-0cefd3f4
In that discussion, Railway states that ECDSA P-256 certificates are now issued by default, while some domains may still serve older RSA certificates until those certificates age out.
Our custom domain app.coolglo.co currently serves an RSA 2048-bit certificate issued by Let's Encrypt YR2, with the chain:
app.coolglo.co → YR2 → Root YR → ISRG Root X1
OpenSSL verification succeeds on Ubuntu, but our customer's enterprise Zscaler gateway blocks the website with "Access denied due to bad server certificate."
Could you please confirm:
- Is our domain still serving an older RSA certificate from before Railway's transition to ECDSA P-256?
- Can Railway migrate or reissue the certificate for our domain to its current default ECDSA P-256 configuration?
- Would doing so change the certificate chain served at Railway's edge, or is the chain determined independently of the key type?
- Is there a supported way to refresh the managed certificate without removing our production domain or risking downtime?
- Are there any known compatibility issues with the current YR2 → Root YR → ISRG Root X1 chain and enterprise security gateways?
We are not asking to disable TLS validation. We want to determine whether Railway can safely move our domain to its current managed certificate configuration and whether that could resolve the enterprise compatibility issue.
2 Replies
Status changed to Awaiting Railway Response Railway • 1 day ago
Status changed to Solved aadllp • 1 day ago
a day ago
why the status changed to "Solved" automatically without any response?
Status changed to Awaiting Railway Response Railway • 1 day ago
21 hours ago
The status change to Solved came from your own account a few seconds after the thread was opened, not from us, so it was most likely a misclick. The thread is open again.
On the certificate: we now issue ECDSA P-256 certificates by default and are phasing out RSA. While that happens, a domain can hold both an RSA and an ECDSA certificate, and either one may be served on a given connection. Both are valid, publicly trusted, and issued for your hostname. Your domain's certificate status is valid and its DNS is set up correctly on our side.
We can't reissue the certificate, remove the RSA one, or pin the domain to ECDSA only, and removing and re-adding the domain won't change what is served. The domain will serve ECDSA only once the RSA certificate ages out.
A client that validates whichever certificate it receives against its trust store accepts either one. If the gateway rejects the RSA certificate or its chain, that comes from how the gateway is configured, for example a trust store missing the issuing roots, or a requirement for one specific key type or issuer. Your customer's gateway administrator can check that against the chain you shared.
Status changed to Awaiting User Response Railway • about 21 hours ago