code: func (c *certificateCache) generateHostCert(principals []string) (ssh.Signer, error) {
  	if len(principals) == 0 {
  		return nil, trace.BadParameter("at least one principal must be provided")
  	}
  
  	// Generate public/private keypair.
  	privBytes, pubBytes, err := c.keygen.GetNewKeyPairFromPool()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// Generate a SSH host certificate.
  	clusterName, err := c.authClient.GetDomainName()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	certBytes, err := c.authClient.GenerateHostCert(
  		pubBytes,
  		principals[0],
  		principals[0],
  		principals,
  		clusterName,
  		teleport.Roles{teleport.RoleNode},
  		0)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// create a *ssh.Certificate
  	privateKey, err := ssh.ParsePrivateKey(privBytes)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	publicKey, _, _, _, err := ssh.ParseAuthorizedKey(certBytes)
  	if err != nil {
  		return nil, err
  	}
  	cert, ok := publicKey.(*ssh.Certificate)
  	if !ok {
  		return nil, trace.BadParameter("not a certificate")
  	}
  
  	// return a ssh.Signer
  	s, err := ssh.NewCertSigner(cert, privateKey)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return s, nil
  }
docs: // generateHostCert will generate a SSH host certificate for a given
  // principal.