Self signed certificate error on startup

[maj]

Hi,

I'm seeing the following error on startup. Can you advise how I debug further?

Thanks, Michael

[10/1/2022, 8:08:25 AM] [homebridge-enphase-envoy] Device: 192.168.6.107 EnphaseIQ, requesting envoyBackboneAppData
 or save envoy id error: Error: self signed certificate, reconnect in 15s.

[grzegorz914]

What a software is installed in Your Envoy?

[maj]

Looks like 7.3.75

[grzegorz914]

So, will not work, firmware 7.x.x and above uses new Authentication method which is none implemented in my plugin at this time. More here: https://github.com/grzegorz914/homebridge-enphase-envoy/wiki#know-issues

[hugo-leij]

Hey @grzegorz914

As expected, I also run into the same problem. A new installation has just been put down with Firmware: D7.0.88.

Is it by any chance on your roadmap to develop this?

Thnx, Greetz Hugo.

[eleventhaus]

How do you manually downgrade firmware and what are the risks?

[savabg]

@grzegorz914 I would love to offer some assistance, but I am not well versed in node - I have been half-able to get the module to work (have been able to get successful responses for a number of the requests) with some very crude tweaks (one being directly injecting the Bearer token).

In terms of steps that I have been able to identify to date

1. Switch this.URL to https instead of http

2. Enable https module (import https)

3. Allow for self signed certificates in axios.create add httpsAgent: new https.Agent({
   rejectUnauthorized: false }),

4. Inject Bearer token in the header in the same section headers: { 'Authorization': 'Bearer ', }

5. Enable cookies and store sessionId cookie as it is needed for the .json requests (Crudely injecting Cookie in after Authorization)

How to obtain bearer token: GET https://enlighten.enphaseenergy.com/entrez-auth-token?serial_num= How to validate validity of token: GET https:///auth/check_jwt -upon successful validation sessionId cookie is generated

[grzegorz914]

I will look in to this, hoverer I don't have device with firmware 7.x.x to test it locally.

[savabg]

@grzegorz914 I can grant access to my Envoy to test it out. Also courtesy of @del13r on another thread for a better process to generate token (although I believe just passing the token as config setting might be the quickest win).

In any case - it appears that a number of the APIs result in 504 errors so it might not just be access related issues that have to be addressed with v7, at present requesting to be downgraded to 5.x seems to be the safest bet all around.

I did some experimenting with cURL and found how to generate the JSON Web Token (JWT) by first obtaining a session ID. 2 step process as follows.

Step 1 Login and generate session_id via cURL (replace my@emailaddress.com and MyPassword)

curl -s https://enlighten.enphaseenergy.com/login/login.json \
-d 'user[email]=my@emailaddress.com&user[password]=MyPassword' \
| jq -r '.session_id'

Results

32alphanumericcharacterSession_ID

Note, session ID's are transient (lasting only for a short time; impermanent) so it is always advisable to do step 1 to refresh your Session ID before trying step 2.

Step 2

cURL command that generates the JSON Web Token (JWT) using the session ID from Step 1. (replace myserialnumber and 32alphanumericcharacterSession_IDFromStep1)

curl -s 'https://enlighten.enphaseenergy.com/entrez-auth-token?serial_num=myserialnumber' \
  -H 'cookie: _enlighten_4_session=32alphanumericcharacterSession_IDFromStep1' \
| jq -r '.token'

Results

ThisIsYourJsonWebToken_Stringof408Characters

This JSON Web Token (JWT) lasts a year.

[grzegorz914]

@savabg, @del13r

I have published v6.0.0-beta to test. In Authorization section You can enable support for FW.7xx.x and paste your generated token. This test version may not working correct at this time, it is only to test correct login to envoy. Please also enable debug mode and always post the log.