[BUG] Stops working when envoy is disconnected from internet

[bergmarmot]

Describe the bug
My enphase gateway was initially connected to the internet. After enphase thought is was a good idea to update my firmware without any notice this HA application was no longer working. After I managed to update the application to the latest version (0.7) it was working again. Realizing that enphase can get into my local network remotely without that I have to grant access I wanted to cutoff the enphase to enter the internet any longer. So I made a firewall rule that block the enphase to communicate to the internet. When I enable this firewall rule then the HA application remains working till the token is expired. Then the HA app is no longer to connect to the enphase system as it seems not to be able to get a new token. My HA system has access to the internet so this should be able to get a new token - but for me it is unclear why it no longer can connect to the enphase gateway. I also noticed that the enphase gateway becomes unresponsive in that situation. It might be that the systems thinks it is connected to the internet as is has LAN connection and that this is causing the system to crash.

Account type

• [ x] Installer
• DIY / DHZ
• Home Owner (This integration is not (fully) functional with a home owner account!)

Envoy

• Metered with CTs installed

• Metered without CTs

• [ x] Standard

• FW version: D8.3.5167

• Amount of micro inverters connected: 8

Home Assistant

• Version: 2025.7.2

Additional context

Relevant snippet of Home Assistant error log. 

[vincentwolsink]

Hi @bergmarmot, the Envoy actually connects to the Enlighten backend to validate the token during the authentication flow. Probably that is also why it becomes unresponsive, because it is stuck waiting for a connection to the Enlighten backend.

[bergmarmot]

Hi @vincentwolsink , thanks for you reply. I doubt whether the gateway checks the token online. I can access the web interface of the gateway that is "off-line" by pasting a valid access token. As the system has no access to the internet it can not validate the submitted token.

I was in the assumption that your script obtains an access token and uses this token to access the gateway interface. Same process when I open this webpage to obtain a token and paste this into the token field of the gateway webinterface. So the gateway can be offline, you only need a valid token to access it. The same would then apply for your script, right?

I have contact with Enphase about the behaviour of the gateway becoming unresponsive when the gateway is disconnected from the internet. My assumption is that the cache of the gateway is causing the system to become unresponsive when it can not send its data to the Enphase servers. Because once I enable access to the internet again for the gateway everything returns to normal.

[vincentwolsink]

There are two different authentication flows. The first one like you just tried with getting a token and then pasting it in the field. The other one is via the "Login with Enphase" button. That one works differently with a challenge code between the Envoy and Enlighten/Entrez.

At some point in the past the first method would not provide the proper installer rights although the user would actually login with an installer account. I then switched to doing authentication via the second method.

[bergmarmot]

I hope I understand everything you say. The HA application you developed is doing the same as the Envoy local webpage. And the obtained access token is then used to access the gateway for reading all the data.

[vincentwolsink]

It was quite a long time ago, that version won’t work in a recent HA anymore. You can try the HA native Enphase integration. That one uses the other token method if I recall correctly.

[bergmarmot]

Ok, I will try, Thanks for the tip.

[vincentwolsink]

If you want to keep most of the functionality on the Envoy but block firmware downloads, maybe there is an option of blocking only the firmware download endpoint through dns for example. I haven’t looked into this myself, but might be an option.

[bergmarmot]

For now I was trying to block all the ip addresses that the envoy tries to connect to - except for 8.8.8.8 - and for now I have registered over 750 IP addresses! Seems envoy is hosted on Amazon servers as most IP ranges belong to Amazon. I also tried to block 443 port as this is the port that is used for a secure connection - but also this resulted the system to become unresponsive after a while. Many people are complaining about the recent firmware as it seems to be full with bugs.

This is how I thought the HA Envoy App was working - so no internet communication between Envoy and the Enphase servers when the HA Envoy app connects to the Envoy gateway and reads data from the device. As said - I could connect to the Envoy gateway when it is responsive and not connected to the internet.

So when Enphase solves the issue of the system becoming unresponsive when it is off-line then I think everything should work as I wish. Enphase would no longer able to access my device and also can not push any other firmware! :-)