The certificate is stuck because Cloudflare's authoritative nameservers are serving stale ACME challenge TXT values that Railway never published, so the certificate authority rejects every validation attempt. This happens when a DNS provider flattens the _acme-challenge CNAME and caches old tokens from a previous order (the delete-and-re-add likely triggered it). A normal dig from a public resolver still looks correct because those resolvers follow the delegation themselves, but the CA's own check hits Cloudflare's cached answer. To fix this, delete the _acme-challenge CNAME record in Cloudflare, wait a minute or two, then recreate it with the same target shown in your Railway dashboard. If Cloudflare keeps serving the old values after that, purge the DNS cache on Cloudflare's side. Once the stale values are gone, the next certificate attempt will pick up the correct token and complete.

Did the remove/re-add of _acme-challenge + cache purge. My Cloudflare DNS is correct: _acme-challenge.brilliantbuy.net is a clean CNAME → dc7n7vb9.authorize.railwaydns.net. But that challenge target resolves inconsistently — it returns the token WN1jd11L… on 1.1.1.1, but returns nothing on 8.8.8.8 and 9.9.9.9. Let's Encrypt can't validate because your delegation target isn't serving the TXT to all resolvers. Please force the certificate re-issue / fix the authorize.railwaydns.net delegation on your end.

The delegation target on our side is serving the correct token (the one you see via 1.1.1.1, which follows the CNAME itself). The inconsistency is that Cloudflare's authoritative nameservers are still answering with two old TXT values from a previous order instead of returning the CNAME for resolvers to follow. The CA queries Cloudflare's nameservers directly, reads those stale values, and rejects the challenge, so re-issuing would fail the same way. The delete/recreate of the _acme-challenge record did not fully clear them. In Cloudflare, try disabling CNAME flattening for that record if the option is available, or fully delete the _acme-challenge CNAME, confirm via Cloudflare's API or dashboard that no leftover TXT entries remain at that name, then recreate the CNAME pointing to the target shown in your Railway dashboard. If Cloudflare keeps serving the old values, open a ticket with Cloudflare support asking them to purge the cached ACME challenge records for that zone.