code: func (s *AuthServer) GenerateHostCert(hostPublicKey []byte, hostID, nodeName string, principals []string, clusterName string, roles teleport.Roles, ttl time.Duration) ([]byte, error) {
  	domainName, err := s.GetDomainName()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// get the certificate authority that will be signing the public key of the host
  	ca, err := s.Trust.GetCertAuthority(services.CertAuthID{
  		Type:       services.HostCA,
  		DomainName: domainName,
  	}, true)
  	if err != nil {
  		return nil, trace.BadParameter("failed to load host CA for '%s': %v", domainName, err)
  	}
  
  	// get the private key of the certificate authority
  	caPrivateKey, err := ca.FirstSigningKey()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// create and sign!
  	return s.Authority.GenerateHostCert(services.HostCertParams{
  		PrivateCASigningKey: caPrivateKey,
  		PublicHostKey:       hostPublicKey,
  		HostID:              hostID,
  		NodeName:            nodeName,
  		Principals:          principals,
  		ClusterName:         clusterName,
  		Roles:               roles,
  		TTL:                 ttl,
  	})
  }
docs: // GenerateHostCert uses the private key of the CA to sign the public key of the host
  // (along with meta data like host ID, node name, roles, and ttl) to generate a host certificate.