I have found answer here: http://openvpn.net/index.php/open-source/documentation/howto.html#auth
Remember, you still need to have server certificate
Using username/password authentication as the only form of client
authentication
By default, using auth-user-pass-verify or a
username/password-checking plugin on the server will enable dual
authentication, requiring that both client-certificate and
username/password authentication succeed in order for the client to be
authenticated.
While it is discouraged from a security perspective, it is also
possible to disable the use of client certificates, and force
username/password authentication only. On the server:
client-cert-not-required Such configurations should usually also set:
username-as-common-name which will tell the server to use the username
for indexing purposes as it would use the Common Name of a client
which was authenticating via a client certificate.
Note that client-cert-not-required will not obviate the need for a
server certificate, so a client connecting to a server which uses
client-cert-not-required may remove the cert and key directives from
the client configuration file, but not the ca directive, because it is
necessary for the client to verify the server certificate.