a month ago
We need help with custom-domain provisioning/routing for a healthy Node service.
Service: ma-x-company (project: abundant-friendship)
Custom domains: ma-x.tech and www.ma-x.tech
Both domains are verified and ACTIVE, but both show CERTIFICATE ISSUE_FAILED / INTERNAL. The service returns HTTP 200 at /healthz on its Railway-provided domain. Direct checks against the Railway-provided custom-domain CNAME target with matching SNI and Host return HTTP 404 for ma-x.tech and HTTP 403 for www.ma-x.tech. No CAA or parent-zone DNSSEC DS record was found. Cloudflare Universal SSL is enabled and SSL/TLS mode is Full.
Please investigate/reset internal custom-domain certificate provisioning and host routing, and advise if Railway-side action or DNS correction is required. We are not deleting/re-adding domains to avoid rate-limit risk. No secrets, customer data, or application logs are included.
1 Replies
Status changed to Awaiting Railway Response Railway • 28 days ago
a month ago
Both certificates are failing because something other than Railway is answering the HTTP-01 ACME challenge path for each domain, so the validation token is never served and issuance cannot complete. For both custom domains, the Cloudflare origin record behind the proxy needs to point at the Railway CNAME target shown in your service's Settings > Networking section, not at any other host. Your www subdomain has a second issue: its CNAME currently resolves to the apex domain instead of the distinct Railway target assigned to it (visible in the same Networking panel). Once the origin records behind Cloudflare point at the correct Railway targets for each domain, certificate issuance and routing will proceed automatically.
Status changed to Awaiting User Response Railway • 28 days ago
21 days ago
This thread has been marked as solved automatically due to a lack of recent activity. Please re-open this thread or create a new one if you require further assistance. Thank you!
Status changed to Solved Railway • 21 days ago