code: func (a *AuthServer) GetClusterCACert() (*LocalCAResponse, error) {
  	clusterName, err := a.GetClusterName()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// Extract the TLS CA for this cluster.
  	hostCA, err := a.GetCache().GetCertAuthority(services.CertAuthID{
  		Type:       services.HostCA,
  		DomainName: clusterName.GetClusterName(),
  	}, false)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	tlsCA, err := hostCA.TLSCA()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// Marshal to PEM bytes to send the CA over the wire.
  	pemBytes, err := tlsca.MarshalCertificatePEM(tlsCA.Cert)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return &LocalCAResponse{
  		TLSCA: pemBytes,
  	}, nil
  }
docs: // GetClusterCACert returns the CAs for the local cluster without signing keys.