We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
terminal.println("");
        terminal.println("If all of your nodes will be accessed through a single domain");
        terminal.println("(e.g. node01.es.example.com, node02.es.example.com, etc) then you may find it");
        terminal.println("simpler to generate one certificate with a wildcard hostname (*.es.example.com)");
        terminal.println("and use that across all of your nodes.");
        terminal.println("");
        terminal.println("However, if you do not have a common domain name, and you expect to add");
        terminal.println("additional nodes to your cluster in the future, then you should generate a");
        terminal.println("certificate per node so that you can more easily generate new certificates when");
        terminal.println("you provision new nodes.");
        terminal.println("");
        return terminal.promptYesNo("Generate a certificate per node?", false);
    }
    private CertOptions getCertificateConfiguration(
        Terminal terminal,
        boolean multipleCertificates,
        String nodeDescription,
        Period validity,
        boolean csr
    ) {
        String certName = null;
        if (multipleCertificates) {
            printHeader("What is the name of " + nodeDescription + "?", terminal);
            terminal.println("This name will be used as part of the certificate file name, and as a");
            terminal.println("descriptive name within the certificate.");
            terminal.println("");
            terminal.println("You can use any descriptive name that you like, but we recommend using the name");
            terminal.println("of the Elasticsearch node.");
            terminal.println("");
            certName = terminal.readText(nodeDescription + " name: ");