We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
}
        
        
        
        
        final UserPrincipal newFileOwner = Files.getOwner(tempGeneratedTlsCertsDir, LinkOption.NOFOLLOW_LINKS);
        if (false == newFileOwner.equals(Files.getOwner(env.configFile(), LinkOption.NOFOLLOW_LINKS))) {
            
            UserException userException = new UserException(
                ExitCodes.CONFIG,
                "Aborting auto configuration because of config dir ownership mismatch. Config dir is owned by "
                    + Files.getOwner(env.configFile(), LinkOption.NOFOLLOW_LINKS).getName()
                    + " but auto-configuration directory would be owned by "
                    + newFileOwner.getName()
            );
            try {
                deleteDirectory(tempGeneratedTlsCertsDir);
            } catch (Exception ex) {
                userException.addSuppressed(ex);
            }
            throw userException;
        }
        final X509Certificate transportCaCert;
        final PrivateKey transportKey;
        final X509Certificate transportCert;
        final PrivateKey httpCaKey;
        final X509Certificate httpCaCert;
        final PrivateKey httpKey;
        final X509Certificate httpCert;
        final List<String> transportAddresses;