code: func (c *certificateCache) GetHostCertificate(addr string, additionalPrincipals []string) (ssh.Signer, error) {
  	var certificate ssh.Signer
  	var err error
  	var ok bool
  
  	var principals []string
  	principals = append(principals, addr)
  	principals = append(principals, additionalPrincipals...)
  
  	certificate, ok = c.get(strings.Join(principals, "."))
  	if !ok {
  		certificate, err = c.generateHostCert(principals)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  
  		err = c.set(addr, certificate, defaults.HostCertCacheTime)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	}
  
  	return certificate, nil
  }
docs: // GetHostCertificate will fetch a certificate from the cache. If the certificate
  // is not in the cache, it will be generated, put in the cache, and returned. Mul
  // Multiple callers can arrive and generate a host certificate at the same time.
  // This is a tradeoff to prevent long delays here due to the expensive
  // certificate generation call.