code: func (s *remoteSite) updateCertAuthorities() error {
  	// update main cluster cert authorities on the remote side
  	// remote side makes sure that only relevant fields
  	// are updated
  	hostCA, err := s.localClient.GetCertAuthority(services.CertAuthID{
  		Type:       services.HostCA,
  		DomainName: s.srv.ClusterName,
  	}, false)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	err = s.remoteClient.RotateExternalCertAuthority(hostCA)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	userCA, err := s.localClient.GetCertAuthority(services.CertAuthID{
  		Type:       services.UserCA,
  		DomainName: s.srv.ClusterName,
  	}, false)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	err = s.remoteClient.RotateExternalCertAuthority(userCA)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// update remote cluster's host cert authoritiy on a local cluster
  	// local proxy is authorized to perform this operation only for
  	// host authorities of remote clusters.
  	remoteCA, err := s.remoteClient.GetCertAuthority(services.CertAuthID{
  		Type:       services.HostCA,
  		DomainName: s.domainName,
  	}, false)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	if remoteCA.GetClusterName() != s.domainName {
  		return trace.BadParameter(
  			"remote cluster sent different cluster name %v instead of expected one %v",
  			remoteCA.GetClusterName(), s.domainName)
  	}
  	err = s.localClient.UpsertCertAuthority(remoteCA)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return s.compareAndSwapCertAuthority(remoteCA)
  }
docs: // updateCertAuthorities updates local and remote cert authorities