Unable to Access Background Maps

Files

proxytest.fmw
- 20 KB
- Download

Question

Why can't I access Background Maps in Data Inspector or Data Preview?

Answer

Background map failures fall into two broad groups, and the error message tells you which one you are dealing with. In Data Preview, with Background Maps on, you may need to try refreshing the map by zooming in and out before getting any error messages in the translation or graphics preview log.

You may see the following error messages:

Connectivity Issues

Your firewall or proxy server may be blocking background map URLs.

“Could not connect to server. Check that you are connected to the internet and that no firewall is blocking outbound connections.”

“... Unable to access network resources, please check your network configuration. Attempted to access... A fatal error has occurred"

Certificate Issues

If the log contains an SSL or certificate error, FME reached the tile service but could not verify the certificate chain it was presented with.

Translation log:

FME Objects Worker [<ID>] > Failed to read feature using the "STADIA" reader

Data Preview Graphics log:

Stadia Maps Reader: Failed to load
'https://tiles.stadiamaps.com/tiles/alidade_smooth/0/0/0.png'.
Error: 'HTTPSConnectionPool(host='tiles.stadiamaps.com', port=443):
Max retries exceeded with url: ...
(Caused by SSLError(SSLCertVerificationError(1,
'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: ...')))'

Two kinds of certificate failure:

Trust failures: a certificate in the chain is not in the trust store. FME does not recognize the issuer. Importing the missing certificate resolves this.

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
self-signed certificate in certificate chain

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
unable to get local issuer certificate

Validation failures: a certificate in your trust store does not meet current validation requirements. The certificate(s) must be corrected and reissued by whoever generated them. FME 2025.0 and later ship Python 3.13 as the default interpreter along with updated OpenSSL libraries. These apply stricter default validation checks than earlier versions.
```
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
Missing Authority Key Identifier
```
Or
```
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
Basic Constraints of CA cert not marked critical
```

Common causes:

SSL/TLS inspection. Corporate proxies, firewalls, VPNs, antivirus, and endpoint protection products frequently intercept HTTPS traffic and re-sign it with an internal CA. FME is then presented with your organisation's certificate chain rather than the tile service's. If that chain is untrusted by FME (your organisation’s certificate not in the trust store), or does not meet the stricter validation requirements above, the connection is rejected.

Missing or outdated public root certificates. Public CAs periodically transition to new root hierarchies. The operating system or certificate bundle used by FME may not contain a recently introduced public root CA. This can occur on systems where certificate updates are disabled or restricted, or in older FME installations using a bundled certificate set.

Resolution

For connectivity and certificate issues, speak to your IT team to confirm the following:

a) Whether a proxy, firewall, VPN, antivirus, endpoint protection, or SSL inspection system is modifying the chain.

If so, add Background Maps URLs to Allowlist and exclude them from SSL/TLS inspection
Please note that a number of proprietary background maps (Esri ArcGIS Online Map Service, Google Maps Engine Map Service, Microsoft Bing Maps, MapBox Web Map Tile Server, MapQuest Web Map Tile Service, Nokia Here Map Service, and Stadia Maps) do not support proxy authentication mode NTLM.

b) For trust failures, import missing certificates into the appropriate trust stores:
(Note: For detailed import steps and OS or component specific trust store locations, see SSL Certificate Handling for FME Transformers)

System Trust Store: used by Background Maps on Windows (certlm.msc), including Stadia Maps
- Eg. Some newer root CAs, such as Sectigo Root E46 (introduced in 2024), may not be available to older FME Form installations or environments with outdated certificate stores and must be imported manually.
FME’s Python certifi bundle <FME install folder>\python\certifi\cacert.pem: used by some Python components and libraries in FME

c) For validation failures, the internal root CA or intermediates must be regenerated to meet current requirements before re-importing.

d) Optionally, point FME at a custom certificate bundle using system environment variables like SSL_CERT_FILE or SSL_CERT_DIR, for environments already standardised on a managed bundle.

If you continue to experience issues, please contact technical support. When contacting support, please attach the log files from the following tests. First, please run proxytest.fmw (download from the Files section). After running the original workspace, open the HTTPCaller transformer properties and change the URL to a website that your internal network will allow, save the workspace with a different name and re-run the workspace. For both tests, please share the log files when you submit a support request.