code: func (process *TeleportProcess) getCertAuthority(conn *Connector, id services.CertAuthID, loadPrivateKeys bool) (services.CertAuthority, error) {
  	if conn.ClientIdentity.ID.Role == teleport.RoleAdmin || conn.ClientIdentity.ID.Role == teleport.RoleAuth {
  		return process.localAuth.GetCertAuthority(id, loadPrivateKeys)
  	}
  	return conn.Client.GetCertAuthority(id, loadPrivateKeys)
  }
docs: // getCertAuthority returns cert authority by ID.
  // In case if auth servers, the role is 'TeleportAdmin' and instead of using
  // TLS client this method uses the local auth server.