(#21970) document response when master != ca
Merge pull request #1824 from kylog/issue/21970-document-certificate

(#21970) document response when master != ca