Troubleshooting Tip: Maps not loading in FortiAnalyzer GUI and returning 'Internal Server Error'

Description

This article describes a possible reason for the Google Maps frames in FortiAnalyzer not loading and instead returning 'Internal Server Error'. The example below is from Device Manager, but the same can occur in FortiView and other pages using Google Maps overlays.

Scope

FortiAnalyzer.

Solution

As mentioned in the article Technical Tip: How to resolve map server connectivity issue, FortiAnalyzer requires access to mapserver.fortinet.com.

To allow the communication, the map server requires the FortiAnalyzer to present a Fortinet-issued embedded certificate, having a CN value matching the FortiAnalyzer Serial Number.

If the correct certificate is not provided, even though the connection to the server is successful, FortiAnalyzer would fail to download the Google API information, as visible from the last message in the debug snippet below:

FAZVM64 # diagnose system mapserver test

* Trying 208.91.114.183:443...
* Connected to mapserver.fortinet.com (208.91.114.183) port 443
* ALPN: curl offers http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/cert/ca.crt
* CApath: /etc/cert/ca
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted http/1.1
* Server certificate:
* subject: C=US; ST=California; L=Sunnyvale; O=Fortinet; OU=FortiManager; CN=mapserver.fortinet.com; emailAddress=support@fortinet.com
* start date: Jan 23 21:56:50 2026 GMT
* expire date: Feb 14 21:56:50 2027 GMT
* issuer: C=US; ST=California; L=Sunnyvale; O=Fortinet; OU=Certificate Authority; CN=fortinet-subca2001; emailAddress=support@fortinet.com
* SSL certificate verify ok.
* using HTTP/1.1
> Send 91 bytes
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 200 OK
< Server: nginx/1.18.0 (Ubuntu)
< Date: Mon, 02 Mar 2026 14:16:02 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 16
< Connection: keep-alive
<
* Connection #0 to host mapserver.fortinet.com left intact
Server response: Hello, session !
Test connectivity successful

Test download pkginfo.json failed

There are two distinct situations in which this can happen:

1. FortiAnalyzer-VM:
   Go to System Settings -> Certificates and check the details of the local Fortinet certificates.
   
   Virtual machines originally deployed before 2019, and still using the original license file, may have certificates with CN=FAZ-VM0000000001 or CN=FAZ-VM0000000000
   In such a case, the solution is to download the new license file from the support portal (Support) and reapply it on the unit under Dashboard -> License Information widget > VM License -> Upload License button.
   This will cause the VM to reboot, and the issue should be resolved after that.

   
   

2. FortiAnalyzer hardware:
   Hardware models of the D-series and older, and the first revisions of some E-series models, may display correct local certificates under System Settings -> Certificates, but in fact use a hardware-level certificate with CN=FortiAnalyzer when communicating with the map servers. There is currently no solution in this case. Contact the Fortinet Technical Support if further information or assistance is required.