code: func (a *AuthServer) RotateExternalCertAuthority(ca services.CertAuthority) error {
  	if ca == nil {
  		return trace.BadParameter("missing certificate authority")
  	}
  	clusterName, err := a.GetClusterName()
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// this is just an extra precaution against local admins,
  	// because this is additionally enforced by RBAC as well
  	if ca.GetClusterName() == clusterName.GetClusterName() {
  		return trace.BadParameter("can not rotate local certificate authority")
  	}
  
  	existing, err := a.Trust.GetCertAuthority(services.CertAuthID{
  		Type:       ca.GetType(),
  		DomainName: ca.GetClusterName(),
  	}, false)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	updated := existing.Clone()
  	updated.SetCheckingKeys(ca.GetCheckingKeys())
  	updated.SetTLSKeyPairs(ca.GetTLSKeyPairs())
  	updated.SetRotation(ca.GetRotation())
  
  	// use compare and swap to protect from concurrent updates
  	// by trusted cluster API
  	if err := a.CompareAndSwapCertAuthority(updated, existing); err != nil {
  		return trace.Wrap(err)
  	}
  
  	return nil
  }
docs: // RotateExternalCertAuthority rotates external certificate authority,
  // this method is called by remote trusted cluster and is used to update
  // only public keys and certificates of the certificate authority.