code: func (s *Server) pruneCARoots() error {
  	if !s.config.ConnectEnabled {
  		return nil
  	}
  
  	state := s.fsm.State()
  	idx, roots, err := state.CARoots(nil)
  	if err != nil {
  		return err
  	}
  
  	_, caConf, err := state.CAConfig()
  	if err != nil {
  		return err
  	}
  
  	common, err := caConf.GetCommonConfig()
  	if err != nil {
  		return err
  	}
  
  	var newRoots structs.CARoots
  	for _, r := range roots {
  		if !r.Active && !r.RotatedOutAt.IsZero() && time.Now().Sub(r.RotatedOutAt) > common.LeafCertTTL*2 {
  			s.logger.Printf("[INFO] connect: pruning old unused root CA (ID: %s)", r.ID)
  			continue
  		}
  		newRoot := *r
  		newRoots = append(newRoots, &newRoot)
  	}
  
  	// Return early if there's nothing to remove.
  	if len(newRoots) == len(roots) {
  		return nil
  	}
  
  	// Commit the new root state.
  	var args structs.CARequest
  	args.Op = structs.CAOpSetRoots
  	args.Index = idx
  	args.Roots = newRoots
  	resp, err := s.raftApply(structs.ConnectCARequestType, args)
  	if err != nil {
  		return err
  	}
  	if respErr, ok := resp.(error); ok {
  		return respErr
  	}
  
  	return nil
  }
docs: // pruneCARoots looks for any CARoots that have been rotated out and expired.