We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
readmeShouldContain.forEach(s -> assertThat(kibanaReadme, containsString(s)));
        shouldNotContain.forEach(s -> assertThat(kibanaReadme, not(containsString(s))));
        assertThat(kibanaYml, containsString("elasticsearch.ssl.certificateAuthorities: [ \"config/elasticsearch-ca.pem\" ]"));
        assertThat(kibanaYml, containsString("https://"));
        shouldNotContain.forEach(s -> assertThat(kibanaYml, not(containsString(s))));
    }
    private PublicKey getPublicKey(PKCS10CertificationRequest pkcs) throws GeneralSecurityException {
        return new JcaPKCS10CertificationRequest(pkcs).getPublicKey();
    }
    private int getRSAKeySize(Key key) {
        assertThat(key, instanceOf(RSAKey.class));
        final RSAKey rsa = (RSAKey) key;
        return rsa.getModulus().bitLength();
    }
    private Tuple<X509Certificate, PrivateKey> readCertificateAndKey(Path pkcs12, char[] password) throws IOException,
        GeneralSecurityException {
        final Map<Certificate, Key> entries = CertParsingUtils.readPkcs12KeyPairs(pkcs12, password, alias -> password);
        assertThat(entries.entrySet(), Matchers.hasSize(1));
        Certificate cert = entries.keySet().iterator().next();
        Key key = entries.get(cert);
        assertThat(cert, instanceOf(X509Certificate.class));
        assertThat(key, instanceOf(PrivateKey.class));
        assertMatchingPair(cert.getPublicKey(), (PrivateKey) key);
        return new Tuple<>((X509Certificate) cert, (PrivateKey) key);
    }
    private <T> T readPemObject(Path path, String expectedType, CheckedFunction<? super byte[], T, IOException> factory)
        throws IOException {
        assertThat(path, isRegularFile());
        final PemReader csrReader = new PemReader(Files.newBufferedReader(path));
        final PemObject csrPem = csrReader.readPemObject();