We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
final Pattern pattern = Pattern.compile(
            "(?s)(" + Pattern.quote(AUTO_CONFIGURATION_START_MARKER) + ".*?" + Pattern.quote(AUTO_CONFIGURATION_END_MARKER) + ")"
        );
        final String existingConfigurationAsString = existingConfigLines.stream().collect(Collectors.joining(System.lineSeparator()));
        final Matcher matcher = pattern.matcher(existingConfigurationAsString);
        if (matcher.find()) {
            final String foundAutoConfigurationSettingsAsString = matcher.group(1);
            final Settings foundAutoConfigurationSettings;
            try {
                foundAutoConfigurationSettings = Settings.builder()
                    .loadFromSource(foundAutoConfigurationSettingsAsString, XContentType.YAML)
                    .build();
            } catch (Exception e) {
                throw new UserException(
                    ExitCodes.IO_ERROR,
                    "Aborting enrolling to cluster. Unable to parse existing configuration file. Error was: " + e.getMessage(),
                    e
                );
            }
            
            final Set<String> expectedAutoConfigurationSettings = new TreeSet<String>(
                List.of(
                    "xpack.security.enabled",
                    "xpack.security.enrollment.enabled",
                    "xpack.security.transport.ssl.keystore.path",
                    "xpack.security.transport.ssl.truststore.path",
                    "xpack.security.transport.ssl.verification_mode",
                    "xpack.security.http.ssl.enabled",
                    "xpack.security.transport.ssl.enabled",
                    "xpack.security.http.ssl.keystore.path",