We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
terminal.addTextInput(shortDays + "d");
        terminal.addTextInput("n"); 
        terminal.addTextInput("30d");
        assertThat(command.readPeriodInput(terminal, "", null, 21), is(Period.ofDays(30)));
        terminal.addTextInput("2m");
        terminal.addTextInput("n"); 
        terminal.addTextInput("2y");
        assertThat(command.readPeriodInput(terminal, "", null, 90), is(Period.ofYears(2)));
    }
    public void testValidityPeriodToString() throws Exception {
        assertThat(HttpCertificateCommand.toString(Period.ofYears(2)), is("2y"));
        assertThat(HttpCertificateCommand.toString(Period.ofMonths(5)), is("5m"));
        assertThat(HttpCertificateCommand.toString(Period.ofDays(60)), is("60d"));
        assertThat(HttpCertificateCommand.toString(Period.ZERO), is("0d"));
        assertThat(HttpCertificateCommand.toString(null), is("N/A"));
        final int y = randomIntBetween(1, 5);
        final int m = randomIntBetween(1, 11);
        final int d = randomIntBetween(1, 30);
        assertThat(HttpCertificateCommand.toString(Period.of(y, m, d)), is(y + "y," + m + "m," + d + "d"));
    }
    public void testGuessFileType() throws Exception {
        MockTerminal terminal = MockTerminal.create();
        final Path caCert = getDataPath("ca.crt");
        final Path caKey = getDataPath("ca.key");
        assertThat(guessFileType(caCert, terminal), is(FileType.PEM_CERT));
        assertThat(guessFileType(caKey, terminal), is(FileType.PEM_KEY));
        final Path certChain = testRoot.resolve("ca.pem");
        try (OutputStream out = Files.newOutputStream(certChain)) {
            Files.copy(getDataPath("testnode.crt"), out);
            Files.copy(caCert, out);