We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/CertGenUtilsTests.java
final boolean doTlsClientCheck,
        final boolean doTlsServerCheck
    ) throws Exception {
        final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("PKIX", "SunJSSE");
        trustManagerFactory.init(trustStore);
        final TrustManager[] trustManagers = trustManagerFactory.getTrustManagers(); 
        X509ExtendedTrustManager x509ExtendedTrustManager = null;
        for (final TrustManager trustManager : trustManagers) {
            if (trustManager instanceof X509ExtendedTrustManager) {
                x509ExtendedTrustManager = (X509ExtendedTrustManager) trustManagers[0];
                break; 
            }
        }
        if (null == x509ExtendedTrustManager) {
            throw new UnsupportedOperationException("Expected at least one javax.net.ssl.X509ExtendedTrustManager");
        }
        
        
        if (doTlsClientCheck) {
            x509ExtendedTrustManager.checkClientTrusted(certChain, "ECDHE_RSA");
        }
        
        
        
        if (doTlsServerCheck) {
            x509ExtendedTrustManager.checkServerTrusted(certChain, "ECDHE_RSA");
        }
    }
}