Railway SSL Certificate Stuck or Not Working (526, 525, Too Many Redirects)

Q: How do I fix "Railway SSL Certificate Stuck or Not Working (526, 525, Too Many Redirects)"?

1. Fix DNS and validation: Make sure the service is deployed and running Check CNAME and the dashboard TXT record with dnschecker.org Apex domains need CNAME flattening, ALIAS or ANAME, otherwise use www Run dig CAA yourdomain.com; any CAA must include letsencrypt.org Check DNSSEC at dnsviz.net Wait up to an hour (occasionally up to 72) after adding the domain 2. Fix Cloudflare: Set SSL/TLS mode to Full (not Flexible, not Full Strict) Turn the proxy off (grey cloud) until Railway shows a green check, then back on Wildcard domains: the _acme-challenge record must not be proxied

Workaround available Custom domains, Cloudflare Updated November 14, 2026How we research

Quick answer

Custom domain SSL problems on Railway are mostly DNS, CAA, DNSSEC or Cloudflare mode issues. Use Cloudflare Full mode (not Flexible or Strict) and verify the CNAME and TXT records.

Most likely fix: Fix DNS and validation

How to fix it

Try these in order — the most common fix is first.

1. Fix DNS and validation
1. Make sure the service is deployed and running
2. Check CNAME and the dashboard TXT record with dnschecker.org
3. Apex domains need CNAME flattening, ALIAS or ANAME, otherwise use www
4. Run dig CAA yourdomain.com; any CAA must include letsencrypt.org
5. Check DNSSEC at dnsviz.net
6. Wait up to an hour (occasionally up to 72) after adding the domain
Did this fix it?
2. Fix Cloudflare
1. Set SSL/TLS mode to Full (not Flexible, not Full Strict)
2. Turn the proxy off (grey cloud) until Railway shows a green check, then back on
3. Wildcard domains: the _acme-challenge record must not be proxied
Did this fix it?

Symptoms

Certificate stuck on 'Validating Challenges', ERR_TOO_MANY_REDIRECTS, Cloudflare error 525 or 526, or browser shows *.up.railway.app.

Why it happens

DNS (CNAME or TXT) not propagated or wrong
CAA records excluding Let's Encrypt, or broken DNSSEC
Cloudflare SSL mode Flexible (redirect loop) or Full (Strict) (error 526)
Service not running so it cannot answer challenges
Re-adding the domain repeatedly hits Let's Encrypt's 5 duplicate certificates per week limit

This guide also covers

railway ssl not working
railway custom domain validating challenges
railway error 526

Still not working?

If Railway keeps failing, you're not alone. See every Railway problem users report or the alternatives people switch to.

Have an app idea? Our small team builds any software: web and mobile apps, games, desktop, AI tools. Price agreed together.

Talk to us

Fixed it? Share this guide

The same problem in other apps

All not loading, error messages & connection guides →

Heroku H12 Request Timeout Error (Heroku)
Vercel FUNCTION_INVOCATION_TIMEOUT (504) Error (Vercel)

Other Railway errors

All 10 Railway errors and fixes →