PLC (S7-1500) direct connection problem with the BadIdentityTokenInvalid warning

[prs4]

Could you please advice what can be wrong with the code based on the FreeOpcUa project example:

async def task(loop):
    host_name = gethostname()
    client_app_uri = f"urn:{host_name}:python:asyncua"
    await setup_self_signed_certificate(
        private_key,
        cert,
        client_app_uri,
        host_name,
        [ExtendedKeyUsageOID.CLIENT_AUTH],
        {
            'countryName': 'xxx',
            'stateOrProvinceName': 'xxx',
            'localityName': 'xxx',
            'organizationName': "xxx",
        })
    client = Client(r'opc.tcp://xxx.xxx.xxx.xxx:4840/', timeout=10)
    client.application_uri = client_app_uri
    await client.set_security(
        SecurityPolicyBasic256Sha256,
        certificate=str(cert),
        private_key=str(private_key),
        server_certificate="PLC-OPCUA.cer"
    )
    try:
        await client.connect()
        print(client.name)
        await client.disconnect()
    except ua.UaError as err:
        print(err)

def main():
    loop = asyncio.get_event_loop()
    loop.set_debug(True)
    loop.run_until_complete(task(loop))
    loop.close()

if __name__ == '__main__':
    main()

(I replaced real values with "xxx" here. The PLC works as OPC UA server, the "PLC-OPCUA.cer" file was generated using the device. The code imports asyncua 1.0.4 elements.)

When I run it I got the following warning:
INFO:asyncua.client.ua_client.UaClient:activate_session
WARNING:asyncua.client.ua_client.UASocketProtocol:ServiceFault (BadIdentityTokenInvalid, diagnostics: DiagnosticInfo(SymbolicId=None, NamespaceURI=None, Locale=None, LocalizedText=None, AdditionalInfo=None, InnerStatusCode=None, InnerDiagnosticInfo=None)) from server received in response to ActivateSessionRequest
Then there are next warnings like "UASocketProtocol:ServiceFault (BadSessionNotActivated...)".

I see a difference in the file type - there was .der in the example, I use here .cer - but I am not sure if it makes a problem.

[prs4]

It seems that user/password for the .cer PLC certificate was missing. After I appended the lines:

client.set_user('xxx')
client.set_password('xxx')

there were only INFO messages:

INFO:asyncua.client.ua_client.UaClient:activate_session
Pure Python Async. Client
INFO:asyncua.client.client:disconnect
INFO:asyncua.client.ua_client.UaClient:close_session
INFO:asyncua.client.ua_client.UASocketProtocol:close_secure_channel
INFO:asyncua.client.ua_client.UASocketProtocol:Request to close socket received
INFO:asyncua.client.ua_client.UASocketProtocol:Socket has closed connection