We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
terminal.addTextInput(outFile.toString());
        final Environment env = newEnvironment();
        final OptionSet options = command.getParser().parse(new String[0]);
        command.execute(terminal, options, env, new ProcessInfo(Map.of(), Map.of(), createTempDir()));
        if (expectLongPasswordWarning) {
            assertThat(terminal.getOutput(), containsString("OpenSSL"));
        } else {
            assertThat(terminal.getOutput(), not(containsString("OpenSSL")));
        }
        Path zipRoot = getZipRoot(outFile);
        
        assertThat(zipRoot.resolve("ca"), isDirectory());
        final Path caPath = zipRoot.resolve("ca/ca.p12");
        final Tuple<X509Certificate, PrivateKey> caCertKey = readCertificateAndKey(caPath, caPassword.toCharArray());
        verifyCertificate(caCertKey.v1(), caDN.replaceFirst("CN=", ""), caYears, List.of(), List.of());
        assertThat(getRSAKeySize(caCertKey.v1().getPublicKey()), is(caKeySize));
        assertThat(getRSAKeySize(caCertKey.v2()), is(caKeySize));
        assertThat(zipRoot.resolve("elasticsearch"), isDirectory());
        for (int i = 0; i < numberCerts; i++) {
            assertThat(zipRoot.resolve("elasticsearch/" + certNames[i]), isDirectory());
            final Path p12Path = zipRoot.resolve("elasticsearch/" + certNames[i] + "/http.p12");
            assertThat(p12Path, isRegularFile());
            final Path readmePath = zipRoot.resolve("elasticsearch/" + certNames[i] + "/README.txt");
            assertThat(readmePath, isRegularFile());
            final String readme = Files.readString(readmePath);
            final Path ymlPath = zipRoot.resolve("elasticsearch/" + certNames[i] + "/sample-elasticsearch.yml");
            assertThat(ymlPath, isRegularFile());
            final String yml = Files.readString(ymlPath);
            final Tuple<X509Certificate, PrivateKey> certAndKey = readCertificateAndKey(p12Path, password.toCharArray());