We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/CertGenUtils.java
}
    /**
     * Generates a RSA key pair with the provided key size (in bits)
     */
    public static KeyPair generateKeyPair(int keysize) throws NoSuchAlgorithmException {
        
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(keysize, Randomness.createSecure());
        return keyPairGenerator.generateKeyPair();
    }
    /**
     * Converts the {@link InetAddress} objects into a {@link GeneralNames} object that is used to represent subject alternative names.
     */
    public static GeneralNames getSubjectAlternativeNames(boolean resolveName, Set<InetAddress> addresses) throws IOException {
        Set<GeneralName> generalNameList = new HashSet<>();
        for (InetAddress address : addresses) {
            if (address.isAnyLocalAddress()) {
                
                for (InetAddress inetAddress : NetworkUtils.getAllAddresses()) {
                    addSubjectAlternativeNames(resolveName, inetAddress, generalNameList);
                }
            } else {
                addSubjectAlternativeNames(resolveName, address, generalNameList);
            }
        }
        return new GeneralNames(generalNameList.toArray(new GeneralName[generalNameList.size()]));
    }
    @SuppressForbidden(reason = "need to use getHostName to resolve DNS name and getHostAddress to ensure we resolved the name")
    private static void addSubjectAlternativeNames(boolean resolveName, InetAddress inetAddress, Set<GeneralName> list) {
        String hostaddress = inetAddress.getHostAddress();