2 hours ago
Service domain *.hirepact.app (port 8080) has been stuck validating, and once failed with "Failed to issue TLS certificate – An internal error occurred". The apex hirepact.app on the same service issued fine.
DNS on Cloudflare, all DNS-only (grey cloud), verified with dig:
- CNAME → 1nqb3xjj.up.railway.app
_acme-challenge CNAME → 1nqb3xjj.authorize.railwaydns.net
_railway-verify TXT present and green in the dashboard
No CAA records on the zone
The TXT challenge resolves through the delegation. I have already retried and removed/re-added the domain once. Subdomains currently serve a certificate that doesn't cover them (ERR_CERT_COMMON_NAME_INVALID). Could you check what's failing server-side?
3 Replies
2 hours ago
Cloudflare's authoritative nameservers are serving their own TXT records at the _acme-challenge host that conflict with the values at the delegation target, so the CA never sees the correct challenge token even though the CNAME delegation itself is correct. Cloudflare can create hidden _acme-challenge TXT records for its own edge certificates that don't appear in the zone's editable record list. Contact Cloudflare support with this evidence and ask them to resolve the conflict with your delegated DNS-01 validation. Once those conflicting TXT records are cleared, a fresh certificate order will be needed since the current authorization is terminal - use the retry control in the domain's networking settings to start one.
Status changed to Awaiting User Response Railway • about 2 hours ago
Railway
Cloudflare's authoritative nameservers are serving their own TXT records at the `_acme-challenge` host that conflict with the values at the delegation target, so the CA never sees the correct challenge token even though the CNAME delegation itself is correct. Cloudflare can create hidden `_acme-challenge` TXT records for its own edge certificates that don't appear in the zone's editable record list. Contact Cloudflare support with this evidence and ask them to resolve the conflict with your delegated DNS-01 validation. Once those conflicting TXT records are cleared, a fresh certificate order will be needed since the current authorization is terminal - use the retry control in the domain's networking settings to start one.
2 hours ago
My service has a custom domain *.hirepact.app on port 8080 that has been stuck on TLS
certificate issuance for hours, and earlier failed with "Failed to issue TLS certificate - An
internal error occurred". The apex hirepact.app on the same service issued fine.
DNS is on Cloudflare, DNS-only: * CNAME -> 1nqb3xjj.up.railway.app, _acme-challenge CNAME ->
1nqb3xjj.authorize.railwaydns.net, _railway-verify TXT verified. No CAA records. I already
removed and re-added the domain once.
What does your side show as the reason issuance is failing, and is there anything I can do
other than retry?
Status changed to Awaiting Railway Response Railway • about 2 hours ago
2 hours ago
Cloudflare's authoritative nameservers are serving their own TXT records at the _acme-challenge host that conflict with the values at the delegation target, so the CA never sees the correct challenge token even though the CNAME delegation itself is correct. Cloudflare can create hidden _acme-challenge TXT records for its own edge certificates that don't appear in the zone's editable record list. Contact Cloudflare support with this evidence and ask them to resolve the conflict with your delegated DNS-01 validation. Once those conflicting TXT records are cleared, the existing authorization is likely terminal, so a fresh certificate order will be needed - you can start one with railway domain certificate retry via the Railway CLI.
Status changed to Awaiting User Response Railway • about 2 hours ago