func (o SignSSHOptions) Modify(cert *ssh.Certificate, _ SignSSHOptions) error {
	switch o.CertType {
	case "":  
	case SSHUserCert:
		cert.CertType = ssh.UserCert
	case SSHHostCert:
		cert.CertType = ssh.HostCert
	default:
		return errors.Errorf("ssh certificate has an unknown type - %s", o.CertType)
	}
	cert.KeyId = o.KeyID
	cert.ValidPrincipals = o.Principals
	return o.ModifyValidity(cert)
}
Modify implements SSHCertModifier and sets the SSHOption in the ssh.Certificate.
package provisioner
import (
	"crypto/rsa"
	"encoding/binary"
	"encoding/json"
	"math/big"
	"strings"
	"time"
	"github.com/pkg/errors"
	"go.step.sm/crypto/keyutil"
	"golang.org/x/crypto/ssh"
)
const (
	SSHUserCert = "user"
	SSHHostCert = "host"
)
type SSHCertModifier interface {
	SignOption
	Modify(cert *ssh.Certificate, opts SignSSHOptions) error
}
type SSHCertValidator interface {
	SignOption
	Valid(cert *ssh.Certificate, opts SignSSHOptions) error
}
type SSHCertOptionsValidator interface {
	SignOption
	Valid(got SignSSHOptions) error
}
type SignSSHOptions struct {
	CertType     string          `json:"certType"`
	KeyID        string          `json:"keyID"`
	Principals   []string        `json:"principals"`
	ValidAfter   TimeDuration    `json:"validAfter,omitempty"`
	ValidBefore  TimeDuration    `json:"validBefore,omitempty"`
	TemplateData json.RawMessage `json:"templateData,omitempty"`
	Backdate     time.Duration   `json:"-"`
}
func (o SignSSHOptions) Validate() error {
	if o.CertType != "" && o.CertType != SSHUserCert && o.CertType != SSHHostCert {
		return errors.Errorf("unknown certType %s", o.CertType)
	}
	return nil
}
func (o SignSSHOptions) Type() uint32 {
	return sshCertTypeUInt32(o.CertType)
}