We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
if (csr) {
            terminal.println("Your private key(s) will be stored as a PEM formatted file.");
            terminal.println("We recommend that you protect your private keys with a password");
            terminal.println("");
            terminal.println("If you do not wish to use a password, simply press <enter> at the prompt below.");
            password = readPassword(terminal, "Provide a password for the private key: ", true);
        } else {
            terminal.println("Your private key(s) will be stored in a PKCS#12 keystore file named \"http.p12\".");
            terminal.println("This type of keystore is always password protected, but it is possible to use a");
            terminal.println("blank password.");
            terminal.println("");
            terminal.println("If you wish to use a blank password, simply press <enter> at the prompt below.");
            password = readPassword(terminal, "Provide a password for the \"http.p12\" file: ", true);
        }
        printHeader("Where should we save the generated files?", terminal);
        if (csr) {
            terminal.println("A number of files will be generated including your private key(s),");
            terminal.println("certificate request(s), and sample configuration options for Elastic Stack products.");
        } else {
            terminal.println("A number of files will be generated including your private key(s),");
            terminal.println("public certificate(s), and sample configuration options for Elastic Stack products.");
        }
        terminal.println("");
        terminal.println("These files will be included in a single zip archive.");
        terminal.println("");
        Path output = resolvePath("elasticsearch-ssl-http.zip");
        output = tryReadInput(terminal, "What filename should be used for the output zip file?", output, this::resolvePath);
        writeZip(output, password, caInfo, certificates, env);
        terminal.println("");
        terminal.println("Zip file written to " + output);