def upload(pending_certificate_id, **kwargs):
    """
    Uploads a (signed) pending certificate. The allowed fields are validated by
    PendingCertificateUploadInputSchema. The certificate is also validated to be
    signed by the correct authority.
    """
    pending_cert = get(pending_certificate_id)
    partial_cert = kwargs
    uploaded_chain = partial_cert["chain"]

    authority = authorities_service.get(pending_cert.authority.id)

    # Construct the chain for cert validation
    if uploaded_chain:
        chain = uploaded_chain + "\n" + authority.authority_certificate.body
    else:
        chain = authority.authority_certificate.body

    parsed_chain = parse_cert_chain(chain)

    # Check that the certificate is actually signed by the CA to avoid incorrect cert pasting
    validators.verify_cert_chain(
        [parse_certificate(partial_cert["body"])] + parsed_chain
    )

    final_cert = create_certificate(pending_cert, partial_cert, pending_cert.user)

    pending_cert_final_result = update(pending_cert.id, resolved_cert_id=final_cert.id)
    update(pending_cert.id, resolved=True)

    log_service.audit_log("resolve_pending_certificate", pending_cert.name, "Resolved the pending certificate")

    return pending_cert_final_result

    Uploads a (signed) pending certificate. The allowed fields are validated by
    PendingCertificateUploadInputSchema. The certificate is also validated to be
    signed by the correct authority.
    
lemur/pending_certificates/service.py