backport of commit 70d5c5e (#28532)

Co-authored-by: Steven Clark <[email protected]>

website/content/api-docs/secret/ssh.mdx

@@ -752,8 +752,9 @@ parameters of the issued certificate can be further customized in this API call.
   set.
 
 - `valid_principals` `(string: "")` – Specifies valid principals, either
-  usernames or hostnames, that the certificate should be signed for.  Required
-  unless the role has specified allow_empty_principals.
+  usernames or hostnames, that the certificate should be signed for. Required
+  unless the role has specified allow_empty_principals or a value has been set for
+  either the default_user or default_user_template role parameters.
 
 - `cert_type` `(string: "user")` – Specifies the type of certificate to be
   created; either "user" or "host".
@@ -936,4 +937,4 @@ $ curl \
   "warnings": null,
   "auth": null
 }
-```
+```