We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
}
    private PrivateKey parseKeyFromPem(String pemFormattedKey, Terminal terminal) throws UserException {
        try {
            return parsePKCS8PemString(pemFormattedKey);
        } catch (Exception e) {
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, "");
            terminal.errorPrintln(
                Terminal.Verbosity.VERBOSE,
                "Failed to parse Private Key from the response of the Enroll Node API: " + e.getMessage()
            );
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, "");
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, ExceptionsHelper.stackTrace(e));
            terminal.errorPrintln(Terminal.Verbosity.VERBOSE, "");
            throw new UserException(
                ExitCodes.DATA_ERROR,
                "Aborting enrolling to cluster. Failed to parse Private Key from the response of the Enroll Node API",
                e
            );
        }
    }
    @SuppressWarnings("unchecked")
    private List<String> getTransportAddresses(Map<String, Object> responseMap) {
        return (List<String>) responseMap.get("nodes_addresses");
    }
    /**
     * Removes existing autoconfiguration from a configuration file, retaining configuration that is user added even within
     * the auto-configuration stanza. It only matches configuration setting keys for auto-configuration as the values depend
     * on the timestamp of the installation time so we can't know with certainty that a user has changed the value
     */
    static List<String> removePreviousAutoconfiguration(List<String> existingConfigLines) throws UserException {