function Get-SamsaraCertificates {
    param($Result)
    $collection = @{ stores = @() }
    Invoke-SamsaraRead $Result 'Local machine certificate store list' {
        $collection.stores = @(Get-ChildItem -LiteralPath 'Cert:\LocalMachine' -ErrorAction Stop)
    }
    foreach ($store in $collection.stores) {
        Invoke-SamsaraRead $Result 'Local machine public certificate metadata' {
            Get-ChildItem -LiteralPath $store.PSPath -ErrorAction Stop | ForEach-Object {
                $Result.data += [pscustomobject]@{ subject = [string]$_.Subject; issuer = [string]$_.Issuer
                    expires = $_.NotAfter.ToUniversalTime().ToString('o'); thumbprint = [string]$_.Thumbprint
                    store = [string]$store.PSChildName }
            }
        }
    }
    $Result.limitations += 'Public LocalMachine certificate metadata only. Private keys, password-protected files, CurrentUser stores, application bindings and off-store certificates are not read.'
}