We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
this.subject = subject;
            this.dnsNames = dnsNames;
            this.ipNames = ipNames;
            this.keySize = keySize;
            this.validity = validity;
        }
    }
    HttpCertificateCommand() {
        super("generate a new certificate (or certificate request) for the Elasticsearch HTTP interface");
    }
    @Override
    public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {
        printHeader("Elasticsearch HTTP Certificate Utility", terminal);
        terminal.println("The 'http' command guides you through the process of generating certificates");
        terminal.println("for use on the HTTP (Rest) interface for Elasticsearch.");
        terminal.println("");
        terminal.println("This tool will ask you a number of questions in order to generate the right");
        terminal.println("set of files for your needs.");
        final CertificateTool.CAInfo caInfo;
        final Period validity;
        final boolean csr = askCertSigningRequest(terminal);
        if (csr) {
            caInfo = null;
            validity = null;
        } else {
            final boolean existingCa = askExistingCertificateAuthority(terminal);
            if (existingCa) {
                caInfo = findExistingCA(terminal, env);
            } else {
                caInfo = createNewCA(terminal);