code: func ClientCertPool(client AccessCache, clusterName string) (*x509.CertPool, error) {
  	pool := x509.NewCertPool()
  	var authorities []services.CertAuthority
  	if clusterName == "" {
  		hostCAs, err := client.GetCertAuthorities(services.HostCA, false, services.SkipValidation())
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		userCAs, err := client.GetCertAuthorities(services.UserCA, false, services.SkipValidation())
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		authorities = append(authorities, hostCAs...)
  		authorities = append(authorities, userCAs...)
  	} else {
  		hostCA, err := client.GetCertAuthority(
  			services.CertAuthID{Type: services.HostCA, DomainName: clusterName},
  			false, services.SkipValidation())
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		userCA, err := client.GetCertAuthority(
  			services.CertAuthID{Type: services.UserCA, DomainName: clusterName},
  			false, services.SkipValidation())
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		authorities = append(authorities, hostCA)
  		authorities = append(authorities, userCA)
  	}
  
  	for _, auth := range authorities {
  		for _, keyPair := range auth.GetTLSKeyPairs() {
  			cert, err := tlsca.ParseCertificatePEM(keyPair.Cert)
  			if err != nil {
  				return nil, trace.Wrap(err)
  			}
  			log.Debugf("ClientCertPool -> %v", CertInfo(cert))
  			pool.AddCert(cert)
  		}
  	}
  	return pool, nil
  }
docs: // ClientCertPool returns trusted x509 cerificate authority pool