We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
}
    private JcaMiscPEMGenerator generator(PrivateKey privateKey, char[] password) throws IOException {
        if (password == null || password.length == 0) {
            return new JcaMiscPEMGenerator(privateKey);
        }
        return new JcaMiscPEMGenerator(privateKey, CertificateTool.getEncrypter(password));
    }
    private Period getCertificateValidityPeriod(Terminal terminal) {
        printHeader("How long should your certificates be valid?", terminal);
        terminal.println("Every certificate has an expiry date. When the expiry date is reached clients");
        terminal.println("will stop trusting your certificate and TLS connections will fail.");
        terminal.println("");
        terminal.println("Best practice suggests that you should either:");
        terminal.println("(a) set this to a short duration (90 - 120 days) and have automatic processes");
        terminal.println("to generate a new certificate before the old one expires, or");
        terminal.println("(b) set it to a longer duration (3 - 5 years) and then perform a manual update");
        terminal.println("a few months before it expires.");
        terminal.println("");
        terminal.println("You may enter the validity period in years (e.g. 3Y), months (e.g. 18M), or days (e.g. 90D)");
        terminal.println("");
        return readPeriodInput(terminal, "For how long should your certificate be valid?", DEFAULT_CERT_VALIDITY, 60);
    }
    private boolean askMultipleCertificates(Terminal terminal) {
        printHeader("Do you wish to generate one certificate per node?", terminal);
        terminal.println("If you have multiple nodes in your cluster, then you may choose to generate a");
        terminal.println("separate certificate for each of these nodes. Each certificate will have its");
        terminal.println("own private key, and will be issued for a specific hostname or IP address.");
        terminal.println("");
        terminal.println("Alternatively, you may wish to generate a single certificate that is valid");
        terminal.println("across all the hostnames or addresses in your cluster.");