We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
final Signature rsa = Signature.getInstance("SHA512withRSA");
        rsa.initSign(privateKey);
        rsa.update(bytes);
        final byte[] signature = rsa.sign();
        rsa.initVerify(publicKey);
        rsa.update(bytes);
        assertTrue("PublicKey and PrivateKey are not a matching pair", rsa.verify(signature));
    }
    private void verifyKibanaDirectory(
        Path zipRoot,
        boolean expectCAFile,
        Iterable<String> readmeShouldContain,
        Iterable<String> shouldNotContain
    ) throws IOException {
        assertThat(zipRoot.resolve("kibana"), isDirectory());
        if (expectCAFile) {
            assertThat(zipRoot.resolve("kibana/elasticsearch-ca.pem"), isRegularFile());
        } else {
            assertThat(zipRoot.resolve("kibana/elasticsearch-ca.pem"), not(pathExists()));
        }
        final Path kibanaReadmePath = zipRoot.resolve("kibana/README.txt");
        assertThat(kibanaReadmePath, isRegularFile());
        final String kibanaReadme = Files.readString(kibanaReadmePath);
        final Path kibanaYmlPath = zipRoot.resolve("kibana/sample-kibana.yml");
        assertThat(kibanaYmlPath, isRegularFile());
        final String kibanaYml = Files.readString(kibanaYmlPath);
        assertThat(kibanaReadme, containsString(kibanaYmlPath.getFileName().toString()));
        assertThat(kibanaReadme, containsString("elasticsearch.hosts"));
        assertThat(kibanaReadme, containsString("https://"));
        assertThat(kibanaReadme, containsString("elasticsearch-ca.pem"));