We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
if (tag.intValue() == GeneralName.dNSName) {
                    assertThat(value, in(hostNames));
                } else if (tag.intValue() == GeneralName.iPAddress) {
                    assertThat(value, in(ipAddresses));
                }
            }
        } else if (san != null) {
            assertThat(san, hasSize(0));
        }
        
        long now = System.currentTimeMillis();
        long nowMinus10Minutes = now - TimeUnit.MINUTES.toMillis(10);
        assertThat(cert.getNotBefore().getTime(), Matchers.lessThanOrEqualTo(now));
        assertThat(cert.getNotBefore().getTime(), Matchers.greaterThanOrEqualTo(nowMinus10Minutes));
        final ZonedDateTime expiry = Instant.ofEpochMilli(cert.getNotBefore().getTime()).atZone(ZoneOffset.UTC).plusYears(years);
        assertThat(cert.getNotAfter().getTime(), is(expiry.toInstant().toEpochMilli()));
    }
    private void verifyChain(X509Certificate... chain) throws GeneralSecurityException {
        for (int i = 1; i < chain.length; i++) {
            assertThat(chain[i - 1].getIssuerX500Principal(), is(chain[i].getSubjectX500Principal()));
            chain[i - 1].verify(chain[i].getPublicKey());
        }
        final X509Certificate root = chain[chain.length - 1];
        assertThat(root.getIssuerX500Principal(), is(root.getSubjectX500Principal()));
    }
    /**
     * Checks that a public + private key are a matching pair.
     */
    private void assertMatchingPair(PublicKey publicKey, PrivateKey privateKey) throws GeneralSecurityException {
        final byte[] bytes = randomByteArrayOfLength(128);