We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
Map.ofEntries(
                        Map.entry("CSR", csrFile),
                        Map.entry("KEY", keyFile),
                        Map.entry("CERT", certName),
                        Map.entry("YML", ymlFile),
                        Map.entry("PASSWORD", hasPassword ? "*" : "")
                    )
                );
                writeTextFile(zip, dirName + "/README.txt", ES_README_CSR, substitutions);
                writePemEntry(zip, dirName + "/" + csrFile, new JcaMiscPEMGenerator(csr));
                writePemEntry(zip, dirName + "/" + keyFile, generator(keyPair.getPrivate(), password));
                writeTextFile(zip, dirName + "/" + ymlFile, ES_YML_CSR, substitutions);
            } else {
                final ZonedDateTime notBefore = ZonedDateTime.now(ZoneOffset.UTC);
                final ZonedDateTime notAfter = notBefore.plus(cert.validity);
                Certificate certificate = CertGenUtils.generateSignedCertificate(
                    cert.subject,
                    sanList,
                    keyPair,
                    ca.certAndKey.cert,
                    ca.certAndKey.key,
                    false,
                    notBefore,
                    notAfter,
                    null
                );
                final String p12Name = "http.p12";
                final String ymlFile = "sample-elasticsearch.yml";
                final Map<String, String> substitutions = buildSubstitutions(
                    env,