code: func (a *AuthWithRoles) RotateExternalCertAuthority(ca services.CertAuthority) error {
  	if ca == nil {
  		return trace.BadParameter("missing certificate authority")
  	}
  	ctx := &services.Context{User: a.user, Resource: ca}
  	if err := a.actionWithContext(ctx, defaults.Namespace, services.KindCertAuthority, services.VerbRotate); err != nil {
  		return trace.Wrap(err)
  	}
  	return a.authServer.RotateExternalCertAuthority(ca)
  }
docs: // RotateExternalCertAuthority rotates external certificate authority,
  // this method is called by a remote trusted cluster and is used to update
  // only public keys and certificates of the certificate authority.