Corporate SSL Interception with FME Form/Desktop

Going to a full URL such as https://tiles.stadiamaps.com/tiles/alidade_smooth/5/19/14.png displays a 401 Error image. There is a certificate issued by “Sectigo ECC Domain Validation Secure Server CA” covering *.stadiamaps.com but I don’t know much about Authority Key Identifiers.

Do you get the same Python exception with other background maps?

I’m not sure this is going to work, but worth a try, under FME Options, Network Proxy, have you tried changing it from No proxy to Use system proxy settings?

Make sure your company IT consider whitelisting the following websites for the Flow machines https://support.safe.com/hc/en-us/articles/25407547782541-URLs-Used-by-FME-and-Safe-Software

Hi ​@dave_oppd 

We have the same problem, and I’m currently working with our IT department to get it resolved. Did you manage to get it sorted? If so, what was the ‘trick’?

Hi ​@arnold_bijlsma

I wanted to follow up on this community reply, but it seems that you've already submitted a support case with us. [Internal ref: 58357] Our team is working on your case, and it does seem like this issue may be related to Python 3.13's stricter SSL certificate validation.

We'll continue the conversation through your support case. Thanks for bringing this to our attention!

I'm experiencing a similar issue. Although the error I see has to do with a self-signed certificate in the chain, while you got: Missing Authority Key Identifier.

But in both cases there is a certificate error while trying to view a background-service.

Can you share how it was resolved (if it was resolved) ? ​@desiree_at_safe 

(1):
Stadia Maps Reader: Failed to load 'https://tiles.stadiamaps.com/tiles/alidade_smooth/11/1045/673.png'. Error: 'HTTPSConnectionPool(host='tiles.stadiamaps.com', port=443): Max retries exceeded with url: /tiles/alidade_smooth/11/1045/673.png (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)')))'
Python Exception <FMEException>: FMEException: 927109: Stadia Maps Reader: Failed to load 'https://tiles.stadiamaps.com/tiles/alidade_smooth/11/1045/673.png'. Error: 'HTTPSConnectionPool(host='tiles.stadiamaps.com', port=443): Max retries exceeded with url: /tiles/alidade_smooth/11/1045/673.png (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)')))'
An error has occurred. Check the logfile above for details
(2):
Stadia Maps Reader: Failed to load 'https://tiles.stadiamaps.com/tiles/alidade_smooth/11/1045/673.png'. Error: 'HTTPSConnectionPool(host='tiles.stadiamaps.com', port=443): Max retries exceeded with url: /tiles/alidade_smooth/11/1045/673.png (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)')))'
Python Exception <FMEException>: FMEException: 927109: Stadia Maps Reader: Failed to load 'https://tiles.stadiamaps.com/tiles/alidade_smooth/11/1045/673.png'. Error: 'HTTPSConnectionPool(host='tiles.stadiamaps.com', port=443): Max retries exceeded with url: /tiles/alidade_smooth/11/1045/673.png (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)')))'
An error has occurred. Check the logfile above for details
 

Hi ​@laurensdelfland,

Thank you for posting your question on the FME Community!

The two errors are related but have different causes:

• Missing Authority Key Identifier (the original post): FME received the certificate but rejected it, because the certificate doesn’t meet the stricter checks in Python 3.13. Python 3.13 is the version FME uses for formats like the Stadia Maps reader. In that case, IT fixed it by reissuing the certificate with Python 3.13.
• Self-signed certificate in certificate chain (your error): the chain FME received ends in a root certificate that FME doesn’t trust.

When FME loads Stadia tiles, it first has to verify the certificate chain the server presents. The most common cause of your error is a corporate proxy, firewall, or endpoint security tool that intercepts HTTPS traffic. It swaps Stadia’s certificate for one issued by your organization’s internal root CA. If that internal root isn’t trusted on the machine running FME, verification fails.

Quick test to confirm SSL inspection

1. Open https://tiles.stadiamaps.com/tiles/alidade_smooth/0/0/0.png in a browser.
2. View the certificate and check the Issuer and the certification chain (Details tab):
   • A public CA (e.g., Sectigo) means the certificate came directly from Stadia.
   • A corporate or internal CA means your network security is intercepting the traffic.
3. If other people in your organization can load background maps fine, repeat the test on one of their machines and compare.

Options

• Temporary workaround: switch to a different background map (e.g., OpenStreetMap or Esri World Imagery) and turn off the default Stadia maps.
• Recommended permanent fix: ask IT to exempt the Stadia tile service from SSL inspection (Do Not Decrypt / Do Not Inspect), specifically tiles.stadiamaps.com and api.stadiamaps.com. The full list of common URLs used by FME is in URLs Used by FME and Safe Software.
• Alternative permanent fix: Have IT import your organization's SSL inspection root CA certificate to this user's machine OS Trusted Root store (certlm.msc > Trusted Root Certificate Authorities folder)

This article is also a great resource for issues with accessing background maps in FME:

• https://support.safe.com/hc/en-us/articles/25407672555661-Unable-to-Access-Background-Maps

If this doesn’t resolve it, please submit a ticket so that our support team can look into this further! When submitting your ticket, please provide the following (if available):

• The issuer shown in the browser test.
• Your FME version and build number.
• Whether the issue affects only your machine or others on the same network.
• Whether this previously worked and the error started appearing recently.
  • Any changes made around the time the issue started, such as an OS or FME upgrade, or changes to your VPN, proxy, or security software.

Hope this helps!

Thank you for your help.
Should this url (https://tiles.stadiamaps.com/tiles/alidade_smooth/0/0/0.png) show a png with the message: “401 Error Invalid Authentication, learn more at docs.stadiamaps.com/authentication”?

On my laptop I am connected through a VPN and I see a corporate certificate. But on my VDI I am not connected through a VPN and I see the certificate from Stadia, but I get the same SSL error (self-signed certificate in chain).

But I will ask IT if they can help me out. Thanks again.