We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
@SuppressForbidden(reason = "Commons IO lib uses the File API")
    private void moveDirectory(Path srcDir, Path dstDir) throws IOException {
        FileUtils.moveDirectory(srcDir.toFile(), dstDir.toFile());
    }
    private GeneralNames getSubjectAltNames(Settings settings) throws IOException {
        Set<GeneralName> generalNameSet = new HashSet<>();
        for (InetAddress ip : NetworkUtils.getAllAddresses()) {
            String ipString = NetworkAddress.format(ip);
            generalNameSet.add(new GeneralName(GeneralName.iPAddress, ipString));
        }
        generalNameSet.add(new GeneralName(GeneralName.dNSName, "localhost"));
        
        generalNameSet.add(new GeneralName(GeneralName.dNSName, System.getenv("HOSTNAME")));
        for (List<String> publishAddresses : List.of(
            NetworkService.GLOBAL_NETWORK_PUBLISH_HOST_SETTING.exists(settings)
                ? NetworkService.GLOBAL_NETWORK_PUBLISH_HOST_SETTING.get(settings)
                : List.<String>of(),
            HttpTransportSettings.SETTING_HTTP_PUBLISH_HOST.exists(settings)
                ? HttpTransportSettings.SETTING_HTTP_PUBLISH_HOST.get(settings)
                : List.<String>of()
        )) {
            for (String publishAddress : publishAddresses) {
                if (InetAddresses.isInetAddress(publishAddress)) {
                    generalNameSet.add(new GeneralName(GeneralName.iPAddress, publishAddress));
                } else {
                    generalNameSet.add(new GeneralName(GeneralName.dNSName, publishAddress));
                }
            }
        }
        return new GeneralNames(generalNameSet.toArray(new GeneralName[0]));