We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
}
        assertThat(guessFileType(certChain, terminal), is(FileType.PEM_CERT_CHAIN));
        final Path tmpP12 = testRoot.resolve("tmp.p12");
        assertThat(guessFileType(tmpP12, terminal), is(FileType.PKCS12));
        final Path tmpJks = testRoot.resolve("tmp.jks");
        assertThat(guessFileType(tmpJks, terminal), is(FileType.JKS));
        final Path tmpKeystore = testRoot.resolve("tmp.keystore");
        writeDummyKeystore(tmpKeystore, "PKCS12");
        assertThat(guessFileType(tmpKeystore, terminal), is(FileType.PKCS12));
        writeDummyKeystore(tmpKeystore, "jks");
        assertThat(guessFileType(tmpKeystore, terminal), is(FileType.JKS));
    }
    public void testTextFileSubstitutions() throws Exception {
        CheckedBiFunction<String, Map<String, String>, String, Exception> copy = (source, subs) -> {
            try (
                InputStream in = new ByteArrayInputStream(source.getBytes(StandardCharsets.UTF_8));
                StringWriter out = new StringWriter();
                PrintWriter writer = new PrintWriter(out)
            ) {
                HttpCertificateCommand.copyWithSubstitutions(in, writer, subs);
                return out.toString().replace("\r\n", "\n");
            }
        };
        assertThat(copy.apply("abc\n", Map.of()), is("abc\n"));
        assertThat(copy.apply("${not_a_var}\n", Map.of()), is("${not_a_var}\n"));
        assertThat(copy.apply("${var}\n", Map.of("var", "xyz")), is("xyz\n"));
        assertThat(copy.apply("#if not\nbody\n#endif\n", Map.of()), is(""));
        assertThat(copy.apply("#if blank\nbody\n#endif\n", Map.of("blank", "")), is(""));
        assertThat(copy.apply("#if yes\nbody\n#endif\n", Map.of("yes", "true")), is("body\n"));
        assertThat(copy.apply("#if yes\ntrue\n#else\nfalse\n#endif\n", Map.of("yes", "*")), is("true\n"));