We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
if (caInfo != null && caInfo.generated) {
                    createZipDirectory(zipStream, "ca");
                    writeCertificateAuthority(zipStream, "ca", caInfo, env);
                }
                createZipDirectory(zipStream, "kibana");
                writeKibanaInfo(zipStream, "kibana", caInfo, env);
                /* TODO
                createZipDirectory(zipStream, "beats");
                writeBeatsInfo(zipStream, "beats", caInfo);
                createZipDirectory(zipStream, "logstash");
                writeLogstashInfo(zipStream, "logstash", caInfo);
                createZipDirectory(zipStream, "lang-clients");
                writeLangClientInfo(zipStream, "lang-clients", caInfo);
                createZipDirectory(zipStream, "other");
                writeMiscellaneousInfo(zipStream, "other", caInfo);
                */
                
                PosixFileAttributeView view = Files.getFileAttributeView(file, PosixFileAttributeView.class);
                if (view != null) {
                    view.setPermissions(Sets.newHashSet(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE));
                }
                success = true;
            } finally {
                if (success == false) {
                    Files.deleteIfExists(file);
                }
            }
        } catch (IOException e) {
            throw new ElasticsearchException("Failed to write ZIP file '" + file + "'", e);
        }