The INTERNAL certificate error on your wildcard domain is caused by your DNS provider serving stale ACME challenge values that no longer match what we published at the delegation target. Your DNS provider is caching old challenge tokens and returning those to the certificate authority instead of following the CNAME to read the current ones, so every issuance attempt fails identically. To fix this, delete the _acme-challenge record at your DNS provider, wait a moment, then recreate it using the value shown in your Railway dashboard. If your provider keeps serving the old values after that, you will need to ask them to flush their cache for that record. Additionally, the wildcard traffic CNAME itself is not yet propagated, so that record also needs to be set to the target shown in your dashboard.