We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
terminal.println("If you have an existing CA certificate and key, then you can use that CA to");
        terminal.println("sign your new http certificate. This allows you to use the same CA across");
        terminal.println("multiple Elasticsearch clusters which can make it easier to configure clients,");
        terminal.println("and may be easier for you to manage.");
        terminal.println("");
        terminal.println("If you do not have an existing CA, one will be generated for you.");
        terminal.println("");
        return terminal.promptYesNo("Use an existing CA?", false);
    }
    private <T> T tryReadInput(Terminal terminal, String prompt, T defaultValue, Function<String, T> parser) {
        final String defaultStr = defaultValue instanceof Period ? toString((Period) defaultValue) : String.valueOf(defaultValue);
        while (true) {
            final String input = terminal.readText(prompt + " [" + defaultStr + "] ");
            if (Strings.isEmpty(input)) {
                return defaultValue;
            }
            T parsed = parser.apply(input);
            if (parsed != null) {
                return parsed;
            }
        }
    }
    static String toString(Period period) {
        if (period == null) {
            return "N/A";
        }
        if (period.isZero()) {
            return "0d";
        }
        List<String> parts = new ArrayList<>(3);