Need to access a certificate in LocalMachine via C#. Is it possible to elevate only that call?

I'd like for the program to be able to be run as a standard user, and only request elevation when the user performs the action that calls into the LocalMachine certificate store. The only way I know of to do this is to create a separate executable that performs the certificate fetch which the un-elevated program can start in with elevation.

Can I do this without a second binary? Also, in case this matters, the call into the certificate store happens via reflection.

Thanks!