We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
Files.deleteIfExists(keystorePath);
                }
            } catch (Exception ex) {
                t.addSuppressed(ex);
            }
            
            try {
                if (Files.exists(
                    env.configFile()
                        .resolve(
                            String.format(
                                Locale.ROOT,
                                TLS_GENERATED_CERTS_DIR_NAME + ".%d.orig",
                                autoConfigDate.toInstant().getEpochSecond()
                            )
                        )
                )) {
                    moveDirectory(
                        env.configFile()
                            .resolve(
                                String.format(
                                    Locale.ROOT,
                                    TLS_GENERATED_CERTS_DIR_NAME + ".%d.orig",
                                    autoConfigDate.toInstant().getEpochSecond()
                                )
                            ),
                        env.configFile().resolve(TLS_GENERATED_CERTS_DIR_NAME)
                    );
                }
            } catch (Exception ex) {