7 days ago
custom domains stuck at "Certificate Authority is
validating challenges" for over 1 hour.
Project: bistro-cejka
Service: bistro-cejka (8080/next-server)
Domains: bistrocejka.cz and www.bistrocejka.cz
DNS is set up correctly:
- bistrocejka.cz: A 69.46.46.68 (using A record because of MX conflict on apex per Railway docs)
- www.bistrocejka.cz: CNAME wb0k1vcy.up.railway.app.
- _railway-verify TXT records present and visible globally
- CAA empty, HTTP serves railway-edge 200 to ACME path Could you check why SSL provisioning is stuck and trigger issuance manually? Thanks!
4 Replies
6 days ago
Where in the docs does it talk about A/MX conflicts...?
Update: clicking "Try Again" on both domains worked —
certificates issued successfully. Both bistrocejka.cz and
www.bistrocejka.cz now have green checkmarks. Thanks!
@pepper — you're right, my wording was imprecise. Railway's
docs don't explicitly discuss A vs CNAME on apex with MX.
What I meant: CNAME records can't coexist with other records
(like MX) at the apex per RFC 1912, so I used an A record
pointing to the IP that Railway's CNAME resolves to
(69.46.46.68). This kept the existing MX for
info@bistrocejka.cz working through the cutover.
Issue resolved — feel free to close.
6 days ago
Keep in mind that using A records is not supported and may cause unexpected behavior.
I'd recommend migrating to Cloudflare's DNS service as they support configurations that visually "bypass" RFC 1912.
Thanks for the recommendation! Noted for later — we'll plan a
Cloudflare DNS migration once we're through the launch period.
Right now our MX for info@bistrocejka.cz is on the same apex and
we just finished a delicate cutover, so we want to avoid another
DNS change immediately. But you're right that CNAME flattening on
Cloudflare would be the cleaner long-term setup.
Appreciate the heads-up!
Status changed to Solved 0x5b62656e5d • 6 days ago