We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
}
            }
        }
        return lines;
    }
    private boolean askCertSigningRequest(Terminal terminal) {
        printHeader("Do you wish to generate a Certificate Signing Request (CSR)?", terminal);
        terminal.println("A CSR is used when you want your certificate to be created by an existing");
        terminal.println("Certificate Authority (CA) that you do not control (that is, you don't have");
        terminal.println("access to the keys for that CA). ");
        terminal.println("");
        terminal.println("If you are in a corporate environment with a central security team, then you");
        terminal.println("may have an existing Corporate CA that can generate your certificate for you.");
        terminal.println("Infrastructure within your organisation may already be configured to trust this");
        terminal.println("CA, so it may be easier for clients to connect to Elasticsearch if you use a");
        terminal.println("CSR and send that request to the team that controls your CA.");
        terminal.println("");
        terminal.println("If you choose not to generate a CSR, this tool will generate a new certificate");
        terminal.println("for you. That certificate will be signed by a CA under your control. This is a");
        terminal.println("quick and easy way to secure your cluster with TLS, but you will need to");
        terminal.println("configure all your clients to trust that custom CA.");
        terminal.println("");
        return terminal.promptYesNo("Generate a CSR?", false);
    }
    private CertificateTool.CAInfo findExistingCA(Terminal terminal, Environment env) throws UserException {
        printHeader("What is the path to your CA?", terminal);
        terminal.println("Please enter the full pathname to the Certificate Authority that you wish to");
        terminal.println("use for signing your new http certificate. This can be in PKCS#12 (.p12), JKS");
        terminal.println("(.jks) or PEM (.crt, .key, .pem) format.");
        final Path caPath = requestPath("CA Path: ", terminal, env, true);