We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
caDN = "CN=" + randomAlphaOfLengthBetween(3, 8);
            caYears = randomIntBetween(1, 3);
            caKeySize = randomFrom(2048, 3072, 4096);
            terminal.addTextInput(caDN);
            terminal.addTextInput(caYears + "y");
            terminal.addTextInput(Integer.toString(caKeySize));
            terminal.addTextInput("n"); 
        } else {
            terminal.addTextInput(randomBoolean() ? "n" : ""); 
            caDN = HttpCertificateCommand.DEFAULT_CA_NAME.toString();
            caYears = HttpCertificateCommand.DEFAULT_CA_VALIDITY.getYears();
            caKeySize = HttpCertificateCommand.DEFAULT_CA_KEY_SIZE;
        }
        final String caPassword = randomPassword(randomBoolean());
        boolean expectLongPasswordWarning = caPassword.length() > 50;
        
        if (randomBoolean()) {
            String longPassword = randomAlphaOfLengthBetween(60, 120);
            terminal.addSecretInput(longPassword);
            terminal.addSecretInput(longPassword);
            terminal.addTextInput("n"); 
            expectLongPasswordWarning = true;
        }
        terminal.addSecretInput(caPassword);
        if ("".equals(caPassword) == false) {
            terminal.addSecretInput(caPassword);
            if (caPassword.length() > 50) {
                terminal.addTextInput("y"); 
            }
        }