We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
* Loads {@code resource} from the classpath, performs variable substitution on it, and then writes it to {@code writer}.
     */
    private void writeTextFile(ZipOutputStream zip, String outputName, String resource, Map<String, String> substitutions) {
        try (
            InputStream stream = getClass().getResourceAsStream("certutil-http/" + resource);
            ZipEntryStream entry = new ZipEntryStream(zip, outputName);
            PrintWriter writer = new PrintWriter(entry, false, StandardCharsets.UTF_8)
        ) {
            if (stream == null) {
                throw new IllegalStateException("Cannot find internal resource " + resource);
            }
            copyWithSubstitutions(stream, writer, substitutions);
            writer.flush();
        } catch (IOException e) {
            throw new UncheckedIOException("Cannot add resource " + resource + " to zip file", e);
        }
    }
    /**
     * Copies the input stream to the writer, while performing variable substitutions.
     * The variable substitution processing supports 2 constructs
     * <ol>
     * <li>
     * For each key in @{code substitutions}, any sequence of <code>${key}</code> in the input is replaced with the
     * substitution value.
     * </li>
     * <li>
     * Any line in the input that has the form <code>#if KEY</code> causes the following block to be output
     * if-only-if KEY exists with a non-empty value in {@code substitutions}.
     * A block is terminated with {@code #endif}. Lines with {@code #else} are also supported. Nested blocks are not supported.
     * </li>