code: func (s *HTTPServer) AgentConnectCARoots(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
  	var args structs.DCSpecificRequest
  	if done := s.parse(resp, req, &args.Datacenter, &args.QueryOptions); done {
  		return nil, nil
  	}
  
  	raw, m, err := s.agent.cache.Get(cachetype.ConnectCARootName, &args)
  	if err != nil {
  		return nil, err
  	}
  	defer setCacheMeta(resp, &m)
  
  	// Add cache hit
  
  	reply, ok := raw.(*structs.IndexedCARoots)
  	if !ok {
  		// This should never happen, but we want to protect against panics
  		return nil, fmt.Errorf("internal error: response type not correct")
  	}
  	defer setMeta(resp, &reply.QueryMeta)
  
  	return *reply, nil
  }
docs: // AgentConnectCARoots returns the trusted CA roots.