diff --git a/tempest/cmd/verify_tempest_config.py b/tempest/cmd/verify_tempest_config.py
index 320c26e20f..9947f2ac8a 100644
--- a/tempest/cmd/verify_tempest_config.py
+++ b/tempest/cmd/verify_tempest_config.py
@@ -103,8 +103,8 @@ def _get_api_versions(os, service):
     endpoint = _get_unversioned_endpoint(client_dict[service].base_url)
 
     http = tempest.lib.common.http.ClosingHttp(
-        CONF.service_clients.disable_ssl_certificate_validation,
-        CONF.service_clients.ca_certificates_file)
+        CONF.identity.disable_ssl_certificate_validation,
+        CONF.identity.ca_certificates_file)
 
     __, body = http.request(endpoint, 'GET')
     client_dict[service].reset_path()
diff --git a/tempest/common/credentials_factory.py b/tempest/common/credentials_factory.py
index dfc827f30f..c22afc14fb 100644
--- a/tempest/common/credentials_factory.py
+++ b/tempest/common/credentials_factory.py
@@ -155,8 +155,8 @@ CREDENTIAL_TYPES = {
 
 DEFAULT_PARAMS = {
     'disable_ssl_certificate_validation':
-        CONF.service_clients.disable_ssl_certificate_validation,
-    'ca_certs': CONF.service_clients.ca_certificates_file,
+        CONF.identity.disable_ssl_certificate_validation,
+    'ca_certs': CONF.identity.ca_certificates_file,
     'trace_requests': CONF.debug.trace_requests
 }
 
diff --git a/tempest/config.py b/tempest/config.py
index d90b129b43..3fd20ab155 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -121,6 +121,13 @@ IdentityGroup = [
     cfg.StrOpt('catalog_type',
                default='identity',
                help="Catalog type of the Identity service."),
+    cfg.BoolOpt('disable_ssl_certificate_validation',
+                default=False,
+                help="Set to True if using self-signed SSL certificates."),
+    cfg.StrOpt('ca_certificates_file',
+               default=None,
+               help='Specify a CA bundle file to use in verifying a '
+                    'TLS (https) server certificate.'),
     cfg.StrOpt('uri',
                help="Full URI of the OpenStack Identity API (Keystone), v2"),
     cfg.StrOpt('uri_v3',
@@ -175,16 +182,6 @@ ServiceClientsGroup = [
                default=60,
                help='Timeout in seconds to wait for the http request to '
                     'return'),
-    cfg.BoolOpt('disable_ssl_certificate_validation',
-                default=False,
-                help="Set to True if using self-signed SSL certificates.",
-                deprecated_group='identity'),
-    cfg.StrOpt('ca_certificates_file',
-               default=None,
-               help='Specify a CA bundle file to use in verifying a '
-                    'TLS (https) server certificate.',
-               deprecated_group='identity'),
-
 ]
 
 identity_feature_group = cfg.OptGroup(name='identity-feature-enabled',
@@ -1418,8 +1415,8 @@ def service_client_config(service_client_name=None):
     """
     _parameters = {
         'disable_ssl_certificate_validation':
-            CONF.service_clients.disable_ssl_certificate_validation,
-        'ca_certs': CONF.service_clients.ca_certificates_file,
+            CONF.identity.disable_ssl_certificate_validation,
+        'ca_certs': CONF.identity.ca_certificates_file,
         'trace_requests': CONF.debug.trace_requests,
         'http_timeout': CONF.service_clients.http_timeout
     }
diff --git a/tempest/manager.py b/tempest/manager.py
index eb936650a5..e3174d4483 100644
--- a/tempest/manager.py
+++ b/tempest/manager.py
@@ -36,13 +36,13 @@ class Manager(clients.ServiceClients):
                "it should not imported directly. It will be removed as "
                "soon as the client manager becomes available in tempest.lib.")
         LOG.warning(msg)
-        dscv = CONF.service_clients.disable_ssl_certificate_validation
+        dscv = CONF.identity.disable_ssl_certificate_validation
         _, uri = tempest_clients.get_auth_provider_class(credentials)
         super(Manager, self).__init__(
             credentials=credentials, scope=scope,
             identity_uri=uri,
             disable_ssl_certificate_validation=dscv,
-            ca_certs=CONF.service_clients.ca_certificates_file,
+            ca_certs=CONF.identity.ca_certificates_file,
             trace_requests=CONF.debug.trace_requests)
 
 
diff --git a/tempest/tests/fake_config.py b/tempest/tests/fake_config.py
index 56aaba630a..71a4c819f9 100644
--- a/tempest/tests/fake_config.py
+++ b/tempest/tests/fake_config.py
@@ -33,7 +33,7 @@ class ConfigFixture(conf_fixture.Config):
         self.conf.set_default('build_interval', 10, group='compute')
         self.conf.set_default('build_timeout', 10, group='compute')
         self.conf.set_default('disable_ssl_certificate_validation', True,
-                              group='service-clients')
+                              group='identity')
         self.conf.set_default('uri', 'http://fake_uri.com/auth',
                               group='identity')
         self.conf.set_default('uri_v3', 'http://fake_uri_v3.com/auth',
@@ -89,9 +89,9 @@ class ServiceClientsConfigFixture(conf_fixture.Config):
         self.conf.set_default('trace_requests', 'fake_module', 'debug')
         # Identity default values
         self.conf.set_default('disable_ssl_certificate_validation', True,
-                              group='service-clients')
+                              group='identity')
         self.conf.set_default('ca_certificates_file', '/fake/certificates',
-                              group='service-clients')
+                              group='identity')
         self.conf.set_default('region', 'fake_region', 'identity')
         # Identity endpoints
         self.conf.set_default('v3_endpoint_type', 'fake_v3_uri', 'identity')
diff --git a/tempest/tests/test_config.py b/tempest/tests/test_config.py
index a5c211ad29..2808a9cf95 100644
--- a/tempest/tests/test_config.py
+++ b/tempest/tests/test_config.py
@@ -41,9 +41,9 @@ class TestServiceClientConfig(base.TestCase):
         for param_name in self.expected_extra_params:
             self.assertNotIn(param_name, params)
         self.assertEqual(
-            self.CONF.service_clients.disable_ssl_certificate_validation,
+            self.CONF.identity.disable_ssl_certificate_validation,
             params['disable_ssl_certificate_validation'])
-        self.assertEqual(self.CONF.service_clients.ca_certificates_file,
+        self.assertEqual(self.CONF.identity.ca_certificates_file,
                          params['ca_certs'])
         self.assertEqual(self.CONF.debug.trace_requests,
                          params['trace_requests'])