diff --git a/manifests/init.pp b/manifests/init.pp
index 0ff3760de..02e08e082 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -291,10 +291,6 @@
 #  (optional) Sets a version cap for messages sent to local cells services
 #  Defaults to $::os_service_default
 #
-# [*upgrade_level_cert*]
-#  (optional) Sets a version cap for messages sent to cert services
-#  Defaults to $::os_service_default
-#
 # [*upgrade_level_compute*]
 #  (optional) Sets a version cap for messages sent to compute services
 #  Defaults to $::os_service_default
@@ -397,6 +393,10 @@
 #   (optional) Allow attach between instance and volume in different availability zones.
 #   Defaults to undef
 #
+# [*upgrade_level_cert*]
+#  (optional) Sets a version cap for messages sent to cert services
+#  Defaults to undef
+#
 class nova(
   $ensure_package                         = 'present',
   $default_transport_url                  = $::os_service_default,
@@ -458,7 +458,6 @@ class nova(
   $notify_on_state_change                 = undef,
   $ovsdb_connection                       = $::os_service_default,
   $upgrade_level_cells                    = $::os_service_default,
-  $upgrade_level_cert                     = $::os_service_default,
   $upgrade_level_compute                  = $::os_service_default,
   $upgrade_level_conductor                = $::os_service_default,
   $upgrade_level_intercell                = $::os_service_default,
@@ -481,6 +480,7 @@ class nova(
   $block_device_allocate_retries          = undef,
   $block_device_allocate_retries_interval = undef,
   $cross_az_attach                        = undef,
+  $upgrade_level_cert                     = undef,
 ) inherits nova::params {
 
   include nova::deps
@@ -521,6 +521,11 @@ Use nova::compute::block_device_allocate_retries_interval instead')
 Use nova::cinder::cross_az_attach instead.')
   }
 
+  if $upgrade_level_cert != undef {
+    warning('The upgrade_level_cert parameter is deprecated and will be removed \
+in a future release.')
+  }
+
   if $use_ssl {
     if !$cert_file {
       fail('The cert_file parameter is required when use_ssl is set to true')
@@ -734,7 +739,7 @@ but should be one of: ssh-rsa, ssh-dsa, ssh-ecdsa.")
 
   nova_config {
     'upgrade_levels/cells':       value => $upgrade_level_cells;
-    'upgrade_levels/cert':        value => $upgrade_level_cert;
+    'upgrade_levels/cert':        value => pick($upgrade_level_cert, $::os_service_default);
     'upgrade_levels/compute':     value => $upgrade_level_compute;
     'upgrade_levels/conductor':   value => $upgrade_level_conductor;
     'upgrade_levels/intercell':   value => $upgrade_level_intercell;
diff --git a/releasenotes/notes/deprecate-upgrade_level_cert-6f7dc745cd652300.yaml b/releasenotes/notes/deprecate-upgrade_level_cert-6f7dc745cd652300.yaml
new file mode 100644
index 000000000..246843401
--- /dev/null
+++ b/releasenotes/notes/deprecate-upgrade_level_cert-6f7dc745cd652300.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - |
+    The ``nova::upgrade_level_cert`` parameter has been deprecated and will be
+    removed in a future release.