We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
try {
                    enrollNodeUrl = createURL(new URL("https://" + address), "/_security/enroll/node", "");
                    enrollResponse = client.execute(
                        "GET",
                        enrollNodeUrl,
                        new SecureString(enrollmentToken.getApiKey().toCharArray()),
                        () -> null,
                        CommandLineHttpClient::responseBuilder
                    );
                    break;
                } catch (Exception e) {
                    terminal.errorPrint(
                        Terminal.Verbosity.NORMAL,
                        "Unable to communicate with the node on " + enrollNodeUrl + ". Error was " + e.getMessage()
                    );
                }
            }
            if (enrollResponse == null || enrollResponse.getHttpStatus() != 200) {
                UserException userException = new UserException(
                    ExitCodes.UNAVAILABLE,
                    "Aborting enrolling to cluster. "
                        + "Could not communicate with the node on any of the addresses from the enrollment token. All of "
                        + enrollmentToken.getBoundAddress()
                        + " were attempted."
                );
                try {
                    deleteDirectory(tempGeneratedTlsCertsDir);
                } catch (Exception ex) {
                    userException.addSuppressed(ex);
                }