diff --git a/internal/services/nginx/nginx_certificate_data_source.go b/internal/services/nginx/nginx_certificate_data_source.go
new file mode 100644
index 0000000000000..feb597c4a972a
--- /dev/null
+++ b/internal/services/nginx/nginx_certificate_data_source.go
@@ -0,0 +1,118 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nginx
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/go-azure-helpers/lang/pointer"
+	"github.com/hashicorp/go-azure-helpers/lang/response"
+	"github.com/hashicorp/go-azure-sdk/resource-manager/nginx/2023-04-01/nginxcertificate"
+	"github.com/hashicorp/go-azure-sdk/resource-manager/nginx/2023-04-01/nginxdeployment"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/sdk"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/validation"
+)
+
+type CertificateDataSourceModel struct {
+	Name                   string `tfschema:"name"`
+	NginxDeploymentId      string `tfschema:"nginx_deployment_id"`
+	KeyVirtualPath         string `tfschema:"key_virtual_path"`
+	CertificateVirtualPath string `tfschema:"certificate_virtual_path"`
+	KeyVaultSecretId       string `tfschema:"key_vault_secret_id"`
+}
+
+type CertificateDataSource struct{}
+
+var _ sdk.DataSource = CertificateDataSource{}
+
+func (m CertificateDataSource) Arguments() map[string]*pluginsdk.Schema {
+	return map[string]*pluginsdk.Schema{
+		"name": {
+			Type:         pluginsdk.TypeString,
+			Required:     true,
+			ValidateFunc: validation.StringIsNotEmpty,
+		},
+
+		"nginx_deployment_id": {
+			Type:         pluginsdk.TypeString,
+			Required:     true,
+			ValidateFunc: nginxdeployment.ValidateNginxDeploymentID,
+		},
+	}
+}
+
+func (m CertificateDataSource) Attributes() map[string]*pluginsdk.Schema {
+	return map[string]*pluginsdk.Schema{
+		"key_virtual_path": {
+			Type:     pluginsdk.TypeString,
+			Computed: true,
+		},
+
+		"certificate_virtual_path": {
+			Type:     pluginsdk.TypeString,
+			Computed: true,
+		},
+
+		"key_vault_secret_id": {
+			Type:     pluginsdk.TypeString,
+			Computed: true,
+		},
+	}
+}
+
+func (m CertificateDataSource) ModelObject() interface{} {
+	return &CertificateDataSourceModel{}
+}
+
+func (m CertificateDataSource) ResourceType() string {
+	return "azurerm_nginx_certificate"
+}
+
+func (m CertificateDataSource) Read() sdk.ResourceFunc {
+	return sdk.ResourceFunc{
+		Timeout: 5 * time.Minute,
+		Func: func(ctx context.Context, metadata sdk.ResourceMetaData) error {
+			client := metadata.Client.Nginx.NginxCertificate
+			var model CertificateDataSourceModel
+			if err := metadata.Decode(&model); err != nil {
+				return err
+			}
+			deploymentId, err := nginxdeployment.ParseNginxDeploymentID(model.NginxDeploymentId)
+			if err != nil {
+				return fmt.Errorf("error parsing NGINX deployment ID %s: %+v", deploymentId, err)
+			}
+			id := nginxcertificate.NewCertificateID(
+				deploymentId.SubscriptionId,
+				deploymentId.ResourceGroupName,
+				deploymentId.NginxDeploymentName,
+				model.Name,
+			)
+			result, err := client.CertificatesGet(ctx, id)
+			if err != nil {
+				if response.WasNotFound(result.HttpResponse) {
+					return fmt.Errorf("%s was not found", id)
+				}
+				return fmt.Errorf("reading %s: %+v", id, err)
+			}
+
+			output := CertificateDataSourceModel{
+				Name:              id.CertificateName,
+				NginxDeploymentId: deploymentId.ID(),
+			}
+
+			if model := result.Model; model != nil {
+				prop := result.Model.Properties
+				output.KeyVirtualPath = pointer.ToString(prop.KeyVirtualPath)
+				output.KeyVaultSecretId = pointer.ToString(prop.KeyVaultSecretId)
+				output.CertificateVirtualPath = pointer.ToString(prop.CertificateVirtualPath)
+			}
+
+			metadata.SetID(id)
+			return metadata.Encode(&output)
+		},
+	}
+}
diff --git a/internal/services/nginx/nginx_certificate_data_source_test.go b/internal/services/nginx/nginx_certificate_data_source_test.go
new file mode 100644
index 0000000000000..9d95709eea307
--- /dev/null
+++ b/internal/services/nginx/nginx_certificate_data_source_test.go
@@ -0,0 +1,41 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nginx_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance/check"
+)
+
+type NginxCertificateDataSource struct{}
+
+func TestAccNginxCertificateDataSource_basic(t *testing.T) {
+	data := acceptance.BuildTestData(t, "data.azurerm_nginx_certificate", "test")
+	r := NginxCertificateDataSource{}
+
+	data.DataSourceTest(t, []acceptance.TestStep{
+		{
+			Config: r.basic(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).Key("certificate_virtual_path").Exists(),
+				check.That(data.ResourceName).Key("key_vault_secret_id").Exists(),
+				check.That(data.ResourceName).Key("key_virtual_path").Exists(),
+			),
+		},
+	})
+}
+
+func (d NginxCertificateDataSource) basic(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%s
+
+data "azurerm_nginx_certificate" "test" {
+  name                = azurerm_nginx_certificate.test.name
+  nginx_deployment_id = azurerm_nginx_deployment.test.id
+}
+`, CertificateResource{}.basic(data))
+}
diff --git a/internal/services/nginx/registration.go b/internal/services/nginx/registration.go
index 399d439c6fa10..6d14e5300ac58 100644
--- a/internal/services/nginx/registration.go
+++ b/internal/services/nginx/registration.go
@@ -31,6 +31,7 @@ func (r Registration) WebsiteCategories() []string {
 func (r Registration) DataSources() []sdk.DataSource {
 	return []sdk.DataSource{
 		DeploymentDataSource{},
+		CertificateDataSource{},
 	}
 }