We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
public static final String AUTO_CONFIG_ALT_DN = "CN=Elasticsearch security auto-configuration HTTP CA";
    
    private static final String SIGNATURE_ALGORITHM = "SHA256withRSA";
    private static final String TRANSPORT_AUTOGENERATED_KEYSTORE_NAME = "transport";
    private static final String TRANSPORT_KEY_KEYSTORE_ENTRY = "transport";
    private static final String TRANSPORT_CA_CERT_KEYSTORE_ENTRY = "transport_ca";
    private static final String ELASTICSEARCH_GROUP_OWNER = "elasticsearch";
    private static final int TRANSPORT_CERTIFICATE_DAYS = 99 * 365;
    private static final int TRANSPORT_CA_CERTIFICATE_DAYS = 99 * 365;
    private static final int TRANSPORT_KEY_SIZE = 4096;
    private static final int TRANSPORT_CA_KEY_SIZE = 4096;
    static final String HTTP_AUTOGENERATED_KEYSTORE_NAME = "http";
    static final String HTTP_KEY_KEYSTORE_ENTRY = "http";
    static final String HTTP_CA_KEY_KEYSTORE_ENTRY = "http_ca";
    static final String HTTP_AUTOGENERATED_CA_NAME = "http_ca";
    private static final int HTTP_CA_CERTIFICATE_DAYS = 3 * 365;
    private static final int HTTP_CA_KEY_SIZE = 4096;
    private static final int HTTP_CERTIFICATE_DAYS = 2 * 365;
    private static final int HTTP_KEY_SIZE = 4096;
    static final String TLS_GENERATED_CERTS_DIR_NAME = "certs";
    static final String AUTO_CONFIGURATION_START_MARKER =
        "#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------";
    static final String AUTO_CONFIGURATION_END_MARKER =
        "#----------------------- END SECURITY AUTO CONFIGURATION -------------------------";
    private final OptionSpec<String> enrollmentTokenParam = parser.accepts("enrollment-token", "The enrollment token to use")
        .withRequiredArg();