diff --git a/doc/source/main/Anchor.rst b/doc/source/main/Anchor.rst
index 0ee8ff504e..5541048a40 100644
--- a/doc/source/main/Anchor.rst
+++ b/doc/source/main/Anchor.rst
@@ -12,7 +12,7 @@ Basic Setup
 # Change the listening port in config.py to 9999
 # I found it useful to run anchor in an additional devstack screen
 # Set in octavia.conf
-## [controller_worker] cert_generator to anchor
+## [certificates] cert_generator to anchor
 ## [haproxy_amphora] server_ca = /opt/stack/anchor/CA/root-ca.crt (Anchor CA)
 # Restart o-cw o-hm o-hk
 
diff --git a/etc/octavia.conf b/etc/octavia.conf
index e900fa27a4..ffa026f6fa 100644
--- a/etc/octavia.conf
+++ b/etc/octavia.conf
@@ -70,6 +70,8 @@
 # cafile =
 
 [certificates]
+# Certificate Generator options are local_cert_generator
+#                                   anchor_cert_generator
 # cert_generator = local_cert_generator
 
 # For local certificate signing (development only):
@@ -188,11 +190,6 @@
 #
 # network_driver = network_noop_driver
 #
-# Certificate Generator options are local_cert_generator
-#                                   barbican_cert_generator
-#                                   anchor_cert_generator
-# cert_generator = local_cert_generator
-#
 # Load balancer topology options are SINGLE, ACTIVE_STANDBY
 # loadbalancer_topology = SINGLE
 # user_data_config_drive = False
diff --git a/octavia/common/config.py b/octavia/common/config.py
index d513f442a0..f34ccfb0da 100644
--- a/octavia/common/config.py
+++ b/octavia/common/config.py
@@ -261,9 +261,6 @@ controller_worker_opts = [
     cfg.StrOpt('network_driver',
                default='network_noop_driver',
                help=_('Name of the network driver to use')),
-    cfg.StrOpt('cert_generator',
-               default='local_cert_generator',
-               help=_('Name of the cert generator to use')),
     cfg.StrOpt('loadbalancer_topology',
                default=constants.TOPOLOGY_SINGLE,
                choices=constants.SUPPORTED_LB_TOPOLOGIES,
diff --git a/octavia/controller/worker/tasks/cert_task.py b/octavia/controller/worker/tasks/cert_task.py
index a3334da66f..6997129074 100644
--- a/octavia/controller/worker/tasks/cert_task.py
+++ b/octavia/controller/worker/tasks/cert_task.py
@@ -29,7 +29,7 @@ class BaseCertTask(task.Task):
         super(BaseCertTask, self).__init__(**kwargs)
         self.cert_generator = stevedore_driver.DriverManager(
             namespace='octavia.cert_generator',
-            name=CONF.controller_worker.cert_generator,
+            name=CONF.certificates.cert_generator,
             invoke_on_load=True,
         ).driver
 
diff --git a/releasenotes/notes/remove-dumplicated-cert_generator-option-83d18647dc1d2954.yaml b/releasenotes/notes/remove-dumplicated-cert_generator-option-83d18647dc1d2954.yaml
new file mode 100644
index 0000000000..1c396b9830
--- /dev/null
+++ b/releasenotes/notes/remove-dumplicated-cert_generator-option-83d18647dc1d2954.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - Remove dumplicated config option 'cert_generator'
+    in [controller_worker]. Operators now should set it
+    under [certificates].