def create_certificate(self, csr, options) -> tuple[str, str, str]:
        """
        :param csr: Certificate Signing Request to turn into a certificate
        :param options: Options passed from the UI (validated by CertificateInputSchema)
        """
        authority = options['authority']
        if not authority:
            raise ValueError("Certificate  requires a signer CA to be specified")
        if authority.plugin_name != GoogleCaIssuerPlugin.slug:
            raise ValueError("Certificate must be created by Google CA")
        ca_options = {opt['name']: opt['value'] for opt in json.loads(authority.options)}
        ca_path = f"projects/{ca_options['Project']}" \
                  f"/locations/{ca_options['Location']}" \
                  f"/caPools/{ca_options['CAPool']}"
        lifetime = get_duration(options)

        client = create_ca_client()
        request = privateca.CreateCertificateRequest(
            parent=ca_path,
            certificate=privateca.Certificate(
                pem_csr=csr,
                lifetime=duration_pb2.Duration(seconds=lifetime)
            ),
            certificate_id=generate_certificate_id(options['common_name']),
            issuing_certificate_authority_id=ca_options['CAName']
        )
        resp = client.create_certificate(request)
        cert_pem = resp.pem_certificate
        chain_pem = '\n'.join(resp.pem_certificate_chain)
        ext_id = request.certificate_id
        return cert_pem, chain_pem, ext_id

        :param csr: Certificate Signing Request to turn into a certificate
        :param options: Options passed from the UI (validated by CertificateInputSchema)
        
lemur/plugins/lemur_google_ca/plugin.py