6 hours ago
Hi Railway team,
My custom domain events.piep.app (service: eventaccess-app, port 8080) shows:
"Failed to issue TLS certificate – Let's Encrypt rate limit reached.
This error cannot be automatically retried. Please check your DNS
configuration or contact support."
What I have verified
-
DNS is correct and publicly propagated (checked via Google Public DNS):
- CNAME events -> sc6izcms.up.railway.app
- TXT _railway-verify.events -> matches the value in the dashboard
Both records show green checks in Railway.
-
Certificate Transparency logs (crt.sh and Cert Spotter) show that
NO certificate has ever been issued for events.piep.app.
-
Only 2 certificates exist for piep.app in the last 7 days
(piep.app and app.piep.app), so neither the duplicate-certificate
limit nor the registered-domain limit should apply.
Timeline (UTC)
-
Earlier: the domain was first added and the error appeared, likely
because issuance was attempted before DNS had propagated.
-
2026-10-26 ~01:56: I removed and re-added the domain once.
The same error appeared immediately.
-
2026-10-26 ~02:04: I updated the CNAME to the new target and
confirmed public propagation. The error is still shown.
Requests
-
Please clear the failed state and trigger a new certificate
issuance for events.piep.app.
-
Please tell me which Let's Encrypt limit was actually hit and when
it resets, so I can avoid this in the future and make sure
automatic renewals will not be affected.
Note: another user reported the exact same error today on verified
custom domains with correct DNS (thread: "TLS certificate rate limit
on verified custom domains"). This suggests a platform-side issue
rather than a problem with my domain configuration.
The temporary *.up.railway.app domain works correctly. I will not
remove or re-add the domain again while waiting for your response.
Thank you,
eljanan
2 Replies
6 hours ago
Your DNS checks out on our side: the CNAME is propagated and domain ownership is verified. The certificate is in a failed state because the certificate authority returned a rate-limit response for this name, and that error type is not retried automatically.
For a rate-limit failure, waiting is the only remedy. A new attempt made before the certificate authority's window clears will fail the same way, so holding off on removing and re-adding the domain is the right call. Our records show the rate-limit response but not which specific Let's Encrypt limit triggered it or when that limit resets, so we can't give you a reset time.
Status changed to Awaiting User Response Railway • about 6 hours ago
Railway
Your DNS checks out on our side: the CNAME is propagated and domain ownership is verified. The certificate is in a failed state because the certificate authority returned a rate-limit response for this name, and that error type is not retried automatically. For a rate-limit failure, waiting is the only remedy. A new attempt made before the certificate authority's window clears will fail the same way, so holding off on removing and re-adding the domain is the right call. Our records show the rate-limit response but not which specific Let's Encrypt limit triggered it or when that limit resets, so we can't give you a reset time.
6 hours ago
Thanks for checking.
Two follow-up questions:
-
Since this error is not retried automatically, what exactly will
trigger a new issuance attempt once the window clears? Will Railway
retry it, or should I remove and re-add the domain myself? If so,
how long do you recommend waiting before doing that?
-
When I re-added the domain, the same error appeared within seconds.
Can you confirm whether a new order was actually sent to Let's
Encrypt, or whether the previous failed state was reused?
If a Railway team member can trigger the retry from your side, that
would be the safest option.
Thank you,
Eljanan
Status changed to Awaiting Railway Response Railway • about 6 hours ago