'Obtain certificate.
Internal function with precondition that `domains` are
consistent with identifiers present in the `csr`.
:param list domains: Domain names.
:param .util.CSR csr: PEM-encoded Certificate Signing
Request. The key used to generate this CSR can be different
than `authkey`.
:param list authzr: List of
:class:`acme.messages.AuthorizationResource`
:returns: `.CertificateResource` and certificate chain (as
returned by `.fetch_chain`).
:rtype: tuple'

def obtain_certificate_from_csr(self, domains, csr, authzr=None):

    if (self.auth_handler is None):
        msg = 'Unable    to    obtain    certificate    because    authenticator    is    not    set.'
        logger.warning(msg)
        raise errors.Error(msg)
    if (self.account.regr is None):
        raise errors.Error('Please    register    with    the    ACME    server    first.')
    logger.debug('CSR:    %s,    domains:    %s', csr, domains)
    if (authzr is None):
        authzr = self.auth_handler.get_authorizations(domains)
    certr = self.acme.request_issuance(jose.ComparableX509(OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr.data)), authzr)
    notify = zope.component.getUtility(interfaces.IDisplay).notification
    retries = 0
    chain = None
    while (retries <= 1):
        if retries:
            notify('Failed    to    fetch    chain,    please    check    your    network    and    continue', pause=True)
        try:
            chain = self.acme.fetch_chain(certr)
            break
        except acme_errors.Error:
            logger.debug('Failed    to    fetch    chain', exc_info=True)
            retries += 1
    if (chain is None):
        raise acme_errors.Error('Failed    to    fetch    chain.    You    should    not    deploy    the    generated    certificate,    please    rerun    the    command    for    a    new    one.')
    return (certr, chain)
