We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
}
    private String validateHostname(String name) {
        if (DERIA5String.isIA5String(name)) {
            return null;
        } else {
            return name + " is not a valid DNS name";
        }
    }
    private String validateIpAddress(String ip) {
        if (InetAddresses.isInetAddress(ip)) {
            return null;
        } else {
            return ip + " is not a valid IP address";
        }
    }
    private X500Principal buildDistinguishedName(String name) {
        return new X500Principal("CN=" + name.replace(".", ",DC="));
    }
    private List<String> readMultiLineInput(Terminal terminal, Function<String, String> validator) {
        final List<String> lines = new ArrayList<>();
        while (true) {
            String input = terminal.readText("");
            if (Strings.isEmpty(input)) {
                break;
            } else {
                final String error = validator.apply(input);
                if (error == null) {
                    lines.add(input);
                } else {
                    terminal.println("Error: " + error);