If you declare ‘Only password’ as auth method, then you don’t need the client cert-key, only the CA cert on client side, the vpn server will act, basically, as an SSL server, where the client will trust the server certificate (thanks to the CA cert of the CA which has signed the server cert)
Cheers,
jonatha