The nova-cert service is deprecated post-Newton, but does not get cleaned up post-upgrade.
https://docs.openstack.org/releasenotes/openstack-ansible/unreleased.html#relnotes-15-0-0-0b1-upgrade-notes
The nova-cert service has been deprecated, is marked for removal in the Ocata release, and will no longer be deployed by the os_nova role.
There should be logic to remove the nova_cert containers from the hosts as well as inventory, and the associated service in Nova need to be deleted as well.