code: func (s *CA) DeactivateCertAuthority(id services.CertAuthID) error {
  	certAuthority, err := s.GetCertAuthority(id, true)
  	if err != nil {
  		if trace.IsNotFound(err) {
  			return trace.NotFound("can not deactivate cert authority %q which does not exist", id.DomainName)
  		}
  		return trace.Wrap(err)
  	}
  
  	err = s.DeleteCertAuthority(id)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	value, err := services.GetCertAuthorityMarshaler().MarshalCertAuthority(certAuthority)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	item := backend.Item{
  		Key:     backend.Key(authoritiesPrefix, deactivatedPrefix, string(id.Type), id.DomainName),
  		Value:   value,
  		Expires: certAuthority.Expiry(),
  		ID:      certAuthority.GetResourceID(),
  	}
  
  	_, err = s.Put(context.TODO(), item)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return nil
  }
docs: // DeactivateCertAuthority moves a CertAuthority from the normal list to
  // the deactivated list.