We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
* cluster. If this is the case, then the default configuration of
     * binding transport layer to localhost will prevent this node to join the cluster even after "successful" enrollment.
     * We check the non-localhost transport addresses that we receive during enrollment and if any of these are not in the
     * list of non-localhost IP addresses that we gather from all interfaces of the current host, we assume that at least
     * some other node in the cluster runs on another host.
     * If the transport layer addresses we found out in enrollment are all localhost, we cannot be sure where we are still
     * on the same host, but we assume that as it is safer to do so and do not bind to non localhost for this node either.
     */
    protected static boolean anyRemoteHostNodeAddress(List<String> allNodesTransportPublishAddresses, InetAddress[] allHostAddresses) {
        final List<InetAddress> allAddressesList = Arrays.asList(allHostAddresses);
        for (String nodeStringAddress : allNodesTransportPublishAddresses) {
            try {
                final URI uri = new URI("http://" + nodeStringAddress);
                final InetAddress nodeAddress = InetAddress.getByName(uri.getHost());
                if (false == nodeAddress.isLoopbackAddress() && false == allAddressesList.contains(nodeAddress)) {
                    
                    return true;
                }
            } catch (URISyntaxException | UnknownHostException e) {
                
            }
        }
        return false;
    }
    private Environment possiblyReconfigureNode(Environment env, Terminal terminal, OptionSet options, ProcessInfo processInfo)
        throws UserException {
        
        
        
        final List<String> existingConfigLines;