code: func (h *Handler) createSSHCert(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
  	var req *client.CreateSSHCertReq
  	if err := httplib.ReadJSON(r, &req); err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	authClient := h.cfg.ProxyClient
  	cap, err := authClient.GetAuthPreference()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	var cert *auth.SSHLoginResponse
  
  	switch cap.GetSecondFactor() {
  	case teleport.OFF:
  		cert, err = h.auth.GetCertificateWithoutOTP(*req)
  	case teleport.OTP, teleport.HOTP, teleport.TOTP:
  		// convert legacy requests to new parameter here. remove once migration to TOTP is complete.
  		if req.HOTPToken != "" {
  			req.OTPToken = req.HOTPToken
  		}
  		cert, err = h.auth.GetCertificateWithOTP(*req)
  	default:
  		return nil, trace.AccessDenied("unknown second factor type: %q", cap.GetSecondFactor())
  	}
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return cert, nil
  }
docs: // createSSHCert is a web call that generates new SSH certificate based
  // on user's name, password, 2nd factor token and public key user wishes to sign
  //
  // POST /v1/webapi/ssh/certs
  //
  // { "user": "bob", "password": "pass", "otp_token": "tok", "pub_key": "key to sign", "ttl": 1000000000 }
  //
  // Success response
  //
  // { "cert": "base64 encoded signed cert", "host_signers": [{"domain_name": "example.com", "checking_keys": ["base64 encoded public signing key"]}] }
  //