code: func GenerateCertificate(authServer *AuthServer, identity TestIdentity) ([]byte, []byte, error) {
  	switch id := identity.I.(type) {
  	case LocalUser:
  		user, err := authServer.GetUser(id.Username)
  		if err != nil {
  			return nil, nil, trace.Wrap(err)
  		}
  		roles, err := services.FetchRoles(user.GetRoles(), authServer, user.GetTraits())
  		if err != nil {
  			return nil, nil, trace.Wrap(err)
  		}
  		if identity.TTL == 0 {
  			identity.TTL = time.Hour
  		}
  		priv, pub, err := authServer.GenerateKeyPair("")
  		if err != nil {
  			return nil, nil, trace.Wrap(err)
  		}
  		certs, err := authServer.generateUserCert(certRequest{
  			publicKey: pub,
  			user:      user,
  			roles:     roles,
  			ttl:       identity.TTL,
  			usage:     identity.AcceptedUsage,
  		})
  		if err != nil {
  			return nil, nil, trace.Wrap(err)
  		}
  		return certs.tls, priv, nil
  	case BuiltinRole:
  		keys, err := authServer.GenerateServerKeys(GenerateServerKeysRequest{
  			HostID:   id.Username,
  			NodeName: id.Username,
  			Roles:    teleport.Roles{id.Role},
  		})
  		if err != nil {
  			return nil, nil, trace.Wrap(err)
  		}
  		return keys.TLSCert, keys.Key, nil
  	default:
  		return nil, nil, trace.BadParameter("identity of unknown type %T is unsupported", identity)
  	}
  }
docs: // GenerateCertificate generates certificate for identity,
  // returns private public key pair