its been going on and off

This is all i have set

This are the records on railway

this is for wildcart *flowsynai.com

This how i set everything still the ssl comes up frequently i will still watch for some days

Did you check screenshoots i attached

Okay I will wait for few days again and see if this is totally fixed

Same thing on nahltime.com — apex served the *.nahltime.com wildcard (ERR_CERT_COMMON_NAME_INVALID) even though the apex cert was issued (saw it in CT logs) but never bound to the edge. Worked for weeks, broke after a wildcard renewal, and remove/re-add only helped for a few hours while burning the LE weekly cert limit. Fix that worked: apex behind Cloudflare proxied (orange) with SSL/TLS = Full, subdomains left grey — Cloudflare serves its own apex cert so Railway's broken edge never comes into it. Grey/DNS-only did nothing; only proxying worked. It's a workaround though — the real bug is Railway not binding the issued apex cert.

Yes exactly mine is working fine now i add to remove the main domian and readd again but this is the second time am having this same issue this week so am on watch reasons why am waiting to see whatsup before closing this ticket

Hello everyone the issue has started again https://flowsynai.com

I’m seeing the same failure pattern on another Railway-hosted domain, so this does not look isolated!!

Setup pattern:

Apex/root custom domain configured on Railway

Wildcard custom domain also configured on Railway

Wildcard subdomains continue to work

Apex/root domain intermittently gets served the wildcard-only certificate

Browser fails with ERR_CERT_COMMON_NAME_INVALID because *.example.com does not cover example.com

I verified this with openssl s_client -servername against the Railway edge IP. The certificate returned for the apex SNI only contained the wildcard SAN, not the apex hostname.

This looks less like a DNS issue and more like a Railway Edge SNI certificate binding issue, where the issued apex certificate is either not being selected or not being bound correctly at the edge.

Removing and re-adding the domain may temporarily help, but it risks burning Let’s Encrypt weekly duplicate certificate limits and does not seem to address the underlying edge binding problem.

Railway should probably investigate the certificate binding / SNI cert map for setups that include both:

example.com

*.example.com

Exactly how can we reachout to railway to solve this now

This is railway issue, they are ignoring my HTTPS cert issues too. All of my sites are offline. They do not care

Wow that means we all in this together am not the only one

Have been able to fixed issue finally myself