We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
private CertificateTool.CAInfo readKeystoreCA(Path ksPath, FileType fileType, Terminal terminal) throws UserException {
        final String storeType = fileType == FileType.PKCS12 ? "PKCS12" : "jks";
        terminal.println("Reading a " + storeType + " keystore requires a password.");
        terminal.println("It is possible for the keystore's password to be blank,");
        terminal.println("in which case you can simply press <ENTER> at the prompt");
        final char[] password = terminal.readSecret("Password for " + ksPath.getFileName() + ":");
        try {
            final Map<Certificate, Key> keys = CertParsingUtils.readKeyPairsFromKeystore(ksPath, storeType, password, alias -> password);
            if (keys.size() != 1) {
                if (keys.isEmpty()) {
                    terminal.println(Terminal.Verbosity.SILENT, "The keystore at " + ksPath + " does not contain any keys ");
                } else {
                    terminal.println(Terminal.Verbosity.SILENT, "The keystore at " + ksPath + " contains " + keys.size() + " keys,");
                    terminal.println(Terminal.Verbosity.SILENT, "but this command requires a keystore with a single key");
                }
                terminal.println("Please try again with a keystore that contains exactly 1 private key entry");
                throw new UserException(ExitCodes.DATA_ERROR, "The CA keystore " + ksPath + " contains " + keys.size() + " keys");
            }
            final Map.Entry<Certificate, Key> pair = keys.entrySet().iterator().next();
            return new CertificateTool.CAInfo((X509Certificate) pair.getKey(), (PrivateKey) pair.getValue());
        } catch (IOException | GeneralSecurityException e) {
            throw new ElasticsearchException("Failed to read keystore " + ksPath, e);
        }
    }
    private CertificateTool.CAInfo readPemCA(Path certPath, Path keyPath, Terminal terminal) throws UserException {
        final X509Certificate cert = readCertificate(certPath, terminal);
        final PrivateKey key = readPrivateKey(keyPath, terminal);
        return new CertificateTool.CAInfo(cert, key);
    }
    private X509Certificate readCertificate(Path path, Terminal terminal) throws UserException {