What is the optimal algorithm for collecting and updating a collection of electronic signature certificates?

Question

Analytics

There is a task to collect a collection of certificates in x.509 format for analytics in the educational process.
What methods of collecting and updating the collection, in your opinion, are optimal?
First of all, they are not interested in self-signed certificates, but "live" ones (used to protect connections, sign documents, etc.). There are no restrictions on the current / withdrawn - no, according to the used EDS / Nash cryptoalgorithms (RSA, GOST, SHAx) - no.
What utilities are better to extract data from certificates for subsequent analytics?