Hey! Dug into this and the holdup is on the DNS side, in a slightly sneaky way.

Some of your DNS provider's nameservers are still answering with an old A record for api.siteopsapp.com pointing at 34.75.31.91 (looks like a previous server, it's running nginx), while others already return the correct CNAME to sgvt2cc7.up.railway.app. Which answer you get depends on where in the world you ask from. From Europe we see the correct CNAME, but from the US the same nameservers (ns1/ns2.globaldomaingroup.com) still hand out the old A record.

Our certificate validation checks run from the US, so they keep landing on that old server and validation can't complete.

To sort it:

1. In your DNS panel, check the records for api on siteopsapp.com. If there's still an A record pointing at 34.75.31.91, delete it so only the CNAME to sgvt2cc7.up.railway.app remains.
2. If the panel already shows just the CNAME, contact your DNS provider (Global Domain Group), since their US nameservers are still serving the old record.
3. You can watch it propagate on whatsmydns.net by checking the A record for api.siteopsapp.com. You want every location showing the Railway CNAME instead of 34.75.31.91.

No need to remove or re-add the domain on Railway. We re-check automatically, so once the DNS answers are consistent everywhere the certificate will issue on its own, usually within half an hour.