We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
final FileType fileType = guessFileType(caPath, terminal);
        switch (fileType) {
            case PKCS12, JKS -> {
                terminal.println(Terminal.Verbosity.VERBOSE, "CA file " + caPath + " appears to be a " + fileType + " keystore");
                return readKeystoreCA(caPath, fileType, terminal);
            }
            case PEM_KEY -> {
                printHeader("What is the path to your CA certificate?", terminal);
                terminal.println(caPath + " appears to be a PEM formatted private key file.");
                terminal.println("In order to use it for signing we also need access to the certificate");
                terminal.println("that corresponds to that key.");
                terminal.println("");
                final Path caCertPath = requestPath("CA Certificate: ", terminal, env, true);
                return readPemCA(caCertPath, caPath, terminal);
            }
            case PEM_CERT -> {
                printHeader("What is the path to your CA key?", terminal);
                terminal.println(caPath + " appears to be a PEM formatted certificate file.");
                terminal.println("In order to use it for signing we also need access to the private key");
                terminal.println("that corresponds to that certificate.");
                terminal.println("");
                final Path caKeyPath = requestPath("CA Key: ", terminal, env, true);
                return readPemCA(caPath, caKeyPath, terminal);
            }
            case PEM_CERT_CHAIN -> {
                terminal.println(Terminal.Verbosity.SILENT, "The file at " + caPath + " contains multiple certificates.");
                terminal.println("That type of file typically represents a certificate-chain");
                terminal.println("This tool requires a single certificate for the CA");
                throw new UserException(ExitCodes.DATA_ERROR, caPath + ": Unsupported file type (certificate chain)");
            }