We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
private static boolean isDirEmpty(Path path) throws IOException {
        
        try (Stream<Path> dirContentsStream = Files.list(path)) {
            return false == dirContentsStream.findAny().isPresent();
        }
    }
    private X509Certificate parseCertificateFromPem(String pemFormattedCert, Terminal terminal) throws Exception {
        try {
            final List<Certificate> certs = CertParsingUtils.readCertificates(
                Base64.getDecoder().wrap(new ByteArrayInputStream(pemFormattedCert.getBytes(StandardCharsets.UTF_8)))
            );
            if (certs.size() != 1) {
                throw new IllegalStateException("Enroll node API returned multiple certificates");
            }
            return (X509Certificate) certs.get(0);
        } catch (Exception e) {
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, "");
            terminal.errorPrintln(
                Terminal.Verbosity.VERBOSE,
                "Failed to parse Certificate from the response of the Enroll Node API: " + e.getMessage()
            );
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, "");
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, ExceptionsHelper.stackTrace(e));
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, "");
            throw new UserException(
                ExitCodes.DATA_ERROR,
                "Aborting enrolling to cluster. Failed to parse Certificate from the response of the Enroll Node API",
                e
            );
        }