We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java
try {
            existingConfigLines = Files.readAllLines(env.configFile().resolve("elasticsearch.yml"), StandardCharsets.UTF_8);
        } catch (IOException e) {
            
            throw new UserException(ExitCodes.IO_ERROR, "Aborting enrolling to cluster. Unable to read elasticsearch.yml.", e);
        }
        final List<String> existingConfigWithoutAutoconfiguration = removePreviousAutoconfiguration(existingConfigLines);
        if (false == existingConfigLines.equals(existingConfigWithoutAutoconfiguration)
            && Files.exists(env.configFile().resolve(TLS_GENERATED_CERTS_DIR_NAME))) {
            terminal.println("");
            terminal.println("This node will be reconfigured to join an existing cluster, using the enrollment token that you provided.");
            terminal.println("This operation will overwrite the existing configuration. Specifically: ");
            terminal.println("  - Security auto configuration will be removed from elasticsearch.yml");
            terminal.println("  - The [" + TLS_GENERATED_CERTS_DIR_NAME + "] config directory will be removed");
            terminal.println("  - Security auto configuration related secure settings will be removed from the elasticsearch.keystore");
            final boolean shouldContinue = terminal.promptYesNo("Do you want to continue with the reconfiguration process", false);
            if (shouldContinue == false) {
                throw new UserException(ExitCodes.OK, "User cancelled operation");
            }
            removeAutoConfigurationFromKeystore(env, terminal);
            try {
                fullyWriteFile(env.configFile(), "elasticsearch.yml", true, stream -> {
                    try (BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(stream, StandardCharsets.UTF_8))) {
                        for (String l : existingConfigWithoutAutoconfiguration) {
                            bw.write(l);
                            bw.newLine();
                        }
                    }
                });
                deleteDirectory(env.configFile().resolve(TLS_GENERATED_CERTS_DIR_NAME));