We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
map.put("CONF_DIR", env.configFile().toAbsolutePath().toString());
        map.putAll(entries);
        return map;
    }
    private void writeKeyStore(
        ZipOutputStream zip,
        String name,
        Certificate certificate,
        PrivateKey key,
        char[] password,
        X509Certificate caCert
    ) throws IOException, GeneralSecurityException {
        final KeyStore pkcs12 = KeyStore.getInstance("PKCS12");
        pkcs12.load(null);
        pkcs12.setKeyEntry("http", key, password, new Certificate[] { certificate });
        if (caCert != null) {
            pkcs12.setCertificateEntry("ca", caCert);
        }
        try (ZipEntryStream entry = new ZipEntryStream(zip, name)) {
            pkcs12.store(entry, password);
        }
    }
    private void writePemEntry(ZipOutputStream zip, String name, PemObjectGenerator generator) throws IOException {
        try (
            ZipEntryStream entry = new ZipEntryStream(zip, name);
            JcaPEMWriter pem = new JcaPEMWriter(new OutputStreamWriter(entry, StandardCharsets.UTF_8))
        ) {
            pem.writeObject(generator);
            pem.flush();
        }