diff --git a/api-ref/source/index.rst b/api-ref/source/index.rst
index d505650938ff..28eb6d2888e0 100644
--- a/api-ref/source/index.rst
+++ b/api-ref/source/index.rst
@@ -37,7 +37,6 @@
 .. include:: os-assisted-volume-snapshots.inc
 .. include:: os-availability-zone.inc
 .. include:: os-cells.inc
-.. include:: os-certificates.inc
 .. include:: os-cloudpipe.inc
 .. include:: os-consoles.inc
 .. include:: os-hosts.inc
@@ -51,6 +50,7 @@
 .. include:: os-simple-tenant-usage.inc
 .. include:: os-server-external-events.inc
 .. include:: extensions.inc
+.. include:: os-certificates.inc
 .. include:: os-networks.inc
 .. include:: os-volumes.inc
 .. include:: images.inc
diff --git a/api-ref/source/os-certificates.inc b/api-ref/source/os-certificates.inc
index af215ace3fd6..c45dcd5caeb1 100644
--- a/api-ref/source/os-certificates.inc
+++ b/api-ref/source/os-certificates.inc
@@ -6,13 +6,12 @@
 
 Creates and shows details for a root certificate.
 
-.. note::
+.. warning::
 
    This API existed solely because of the need to build euca bundles
    when Nova had an in tree EC2 API. It no longer interacts with any
-   parts of the system besides it's own certificate daemon. It should
-   be considered vestigial, and will likely be deprecated and removed
-   in the near future.
+   parts of the system besides it's own certificate daemon. It is
+   deprecated and will be removed in the near future.
 
 Create Root Certificate
 =======================
diff --git a/nova/cmd/cert.py b/nova/cmd/cert.py
index 9e199d779783..b4298cb6011d 100644
--- a/nova/cmd/cert.py
+++ b/nova/cmd/cert.py
@@ -17,10 +17,12 @@
 import sys
 
 from oslo_log import log as logging
+from oslo_log import versionutils
 from oslo_reports import guru_meditation_report as gmr
 
 import nova.conf
 from nova import config
+from nova.i18n import _LW
 from nova import objects
 from nova import service
 from nova import utils
@@ -34,6 +36,11 @@ def main():
     logging.setup(CONF, "nova")
     utils.monkey_patch()
     objects.register_all()
+    log = logging.getLogger(__name__)
+    versionutils.report_deprecated_feature(
+        log,
+        _LW('The nova-cert service is deprecated and will be removed '
+            'in a future release.'))
 
     gmr.TextGuruMeditation.setup_autorun(version)
 
diff --git a/releasenotes/notes/deprecate_os_cert-f0aa07bab1a229aa.yaml b/releasenotes/notes/deprecate_os_cert-f0aa07bab1a229aa.yaml
new file mode 100644
index 000000000000..e673eefd7d86
--- /dev/null
+++ b/releasenotes/notes/deprecate_os_cert-f0aa07bab1a229aa.yaml
@@ -0,0 +1,9 @@
+---
+deprecations:
+
+  - The ``/os-certificates`` API is deprecated, as well as the
+    ``nova-cert`` service which powers it. This is a vestigial part of
+    the Nova API that existed only for EC2 support, which is now
+    maintained out of tree. It does not interact with any of the rest
+    of nova, and should not just be used as a certificates as a
+    service, which is all it is currently good for.