We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
* </ol>
     */
    static void copyWithSubstitutions(InputStream stream, PrintWriter writer, Map<String, String> substitutions) throws IOException {
        boolean skip = false;
        for (String line : Streams.readAllLines(stream)) {
            for (Map.Entry<String, String> subst : substitutions.entrySet()) {
                line = line.replace("${" + subst.getKey() + "}", subst.getValue());
            }
            if (line.startsWith("#if ")) {
                final String key = line.substring(4).trim();
                skip = Strings.isNullOrEmpty(substitutions.get(key));
                continue;
            } else if (line.equals("#else")) {
                skip = skip == false;
                continue;
            } else if (line.equals("#endif")) {
                skip = false;
                continue;
            } else if (skip) {
                continue;
            }
            writer.println(line);
        }
    }
    private Map<String, String> buildSubstitutions(Environment env, Map<String, String> entries) {
        final Map<String, String> map = Maps.newMapWithExpectedSize(entries.size() + 4);
        ZonedDateTime now = ZonedDateTime.now().withNano(0);
        map.put("DATE", now.format(DateTimeFormatter.ISO_LOCAL_DATE));
        map.put("TIME", now.format(DateTimeFormatter.ISO_OFFSET_TIME));
        map.put("VERSION", Version.CURRENT.toString());