a month ago
Project agent-portal (id 756e1c9e-483a-4059-a97b-57ae6b9c3732), environment dev (id 63580bfa-e7dd-426a-b452-82a2b1f80b8d).
Three custom domains added 2026-07-19 ~17:20 PT have been stuck in CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP with an empty certificates array ever since:
┌────────────────────────────────────────────┬────────────────────────┬─────────────────────────┐
│ Domain │ Service │ CNAME target │
├────────────────────────────────────────────┼────────────────────────┼─────────────────────────┤
│ dashboard-api-dev.merchantservicedepot.com │ dashboard-api-dev │ qdy5gpc7.up.railway.app │
├────────────────────────────────────────────┼────────────────────────┼─────────────────────────┤
│ issuing-api-dev.merchantservicedepot.com │ issuing-portal-api-dev │ ze3i9l9u.up.railway.app │
├────────────────────────────────────────────┼────────────────────────┼─────────────────────────┤
│ gateway-api-dev.merchantservicedepot.com │ gateway-portal-api-dev │ y150nbww.up.railway.app │
└────────────────────────────────────────────┴────────────────────────┴─────────────────────────┘
Already verified on our side:
- Your GraphQL API reports every required DNS record as DNS_RECORD_STATUS_PROPAGATED; only a CNAME is requested (no TXT), and values match exactly.
- No CAA records on the zone; no DNSSEC; no Cloudflare proxy (plain GoDaddy DNS).
- Port 80 and /.well-known/acme-challenge/* on these hosts reach your edge and behave identically to our working domain spend-dev.merchantservicedepot.com in the same project.
- HTTPS on the new domains still serves the *.up.railway.app wildcard cert.
- One domain was deleted/re-added once to retrigger validation — no change. We have NOT retried further to stay clear of Let's Encrypt duplicate-certificate rate limits.
Could you kick certificate issuance for these three domains, or tell us what's blocking it?
1 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
You need to add a TXT record for _railway-verify.dashboard-api-dev.merchantservicedepot.com. If you are using the API to add your custom domain, you can find it in verificationToken under status. Same thing for _railway-verify.issuing-api-dev.merchantservicedepot.com, and _railway-verify.gateway-api-dev.merchantservicedepot.com.