We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
terminal.addTextInput(randomBoolean() ? "y" : ""); 
        
        ipAddresses.forEach(terminal::addTextInput);
        terminal.addTextInput(""); 
        terminal.addTextInput(randomBoolean() ? "y" : ""); 
        terminal.addTextInput(randomBoolean() ? "n" : ""); 
        final String password = randomPassword(false);
        terminal.addSecretInput(password);
        if ("".equals(password) == false) {
            terminal.addSecretInput(password);
        } 
        terminal.addTextInput(outFile.toString());
        final Environment env = newEnvironment();
        final OptionSet options = command.getParser().parse(new String[0]);
        command.execute(terminal, options, env, new ProcessInfo(Map.of(), Map.of(), createTempDir()));
        Path zipRoot = getZipRoot(outFile);
        assertThat(zipRoot.resolve("elasticsearch"), isDirectory());
        final Path csrPath = zipRoot.resolve("elasticsearch/http-" + certificateName + ".csr");
        final PKCS10CertificationRequest csr = readPemObject(csrPath, "CERTIFICATE REQUEST", PKCS10CertificationRequest::new);
        final Path keyPath = zipRoot.resolve("elasticsearch/http-" + certificateName + ".key");
        final AtomicBoolean wasEncrypted = new AtomicBoolean(false);
        final PrivateKey privateKey = PemUtils.readPrivateKey(keyPath, () -> {
            wasEncrypted.set(true);
            return password.toCharArray();
        });
        if ("".equals(password) == false) {
            assertTrue("Password should have been required to decrypted key", wasEncrypted.get());
        }
        final Path esReadmePath = zipRoot.resolve("elasticsearch/README.txt");
        assertThat(esReadmePath, isRegularFile());