diff --git a/deployment/octavia/octavia-deployment-config.j2.yaml b/deployment/octavia/octavia-deployment-config.j2.yaml
index f9374acc24..1b86bde014 100644
--- a/deployment/octavia/octavia-deployment-config.j2.yaml
+++ b/deployment/octavia/octavia-deployment-config.j2.yaml
@@ -34,6 +34,13 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  StackAction:
+    type: string
+    description: >
+      Heat action on performed top-level stack.  Note StackUpdateType is
+      set to UPGRADE when a major-version upgrade is in progress.
+    constraints:
+    - allowed_values: ['CREATE', 'UPDATE']
   OctaviaPostWorkflowName:
     description: Mistral workflow name for octavia configuration steps
                  once the overcloud is ready.
@@ -187,6 +194,13 @@ conditions:
       - raw
     - get_param: NovaEnableRbdBackend
 
+  generate_certs:
+      and:
+      - get_param: OctaviaGenerateCerts
+      - equals:
+        - get_param: StackAction
+        - CREATE
+
 resources:
 {% if not octavia_standalone %}
   default_key_pair:
@@ -226,7 +240,7 @@ resources:
           server_certs_key_passphrase: {get_param: OctaviaServerCertsKeyPassphrase}
           ca_passphrase: { get_param: OctaviaCaKeyPassphrase }
           client_cert_path: { get_param: OctaviaClientCertFile }
-          generate_certs: { get_param: OctaviaGenerateCerts }
+          generate_certs: {if: [generate_certs, true, false]}
           mgmt_port_dev: { get_param: OctaviaMgmtPortDevName }
           os_password: { get_param: AdminPassword }
           os_project_name: 'admin'