We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
}
            terminal.println(Terminal.Verbosity.VERBOSE, "Using the following CA:");
            terminal.println(Terminal.Verbosity.VERBOSE, "\tSubject: " + caInfo.certAndKey.cert.getSubjectX500Principal());
            terminal.println(Terminal.Verbosity.VERBOSE, "\tIssuer: " + caInfo.certAndKey.cert.getIssuerX500Principal());
            terminal.println(Terminal.Verbosity.VERBOSE, "\tSerial: " + caInfo.certAndKey.cert.getSerialNumber());
            terminal.println(Terminal.Verbosity.VERBOSE, "\tExpiry: " + caInfo.certAndKey.cert.getNotAfter());
            terminal.println(Terminal.Verbosity.VERBOSE, "\tSignature Algorithm: " + caInfo.certAndKey.cert.getSigAlgName());
            validity = getCertificateValidityPeriod(terminal);
        }
        final boolean multipleCertificates = askMultipleCertificates(terminal);
        final List<CertOptions> certificates = new ArrayList<>();
        String nodeDescription = multipleCertificates ? "node #1" : "your nodes";
        while (true) {
            final CertOptions cert = getCertificateConfiguration(terminal, multipleCertificates, nodeDescription, validity, csr);
            terminal.println(Terminal.Verbosity.VERBOSE, "Generating the following " + (csr ? "CSR" : "Certificate") + ":");
            terminal.println(Terminal.Verbosity.VERBOSE, "\tName: " + cert.name);
            terminal.println(Terminal.Verbosity.VERBOSE, "\tSubject: " + cert.subject);
            terminal.println(Terminal.Verbosity.VERBOSE, "\tDNS Names: " + Strings.collectionToCommaDelimitedString(cert.dnsNames));
            terminal.println(Terminal.Verbosity.VERBOSE, "\tIP Names: " + Strings.collectionToCommaDelimitedString(cert.ipNames));
            terminal.println(Terminal.Verbosity.VERBOSE, "\tKey Size: " + cert.keySize);
            terminal.println(Terminal.Verbosity.VERBOSE, "\tValidity: " + toString(cert.validity));
            certificates.add(cert);
            if (multipleCertificates && terminal.promptYesNo("Generate additional certificates?", true)) {
                nodeDescription = "node #" + (certificates.size() + 1);
            } else {
                break;
            }
        }
        printHeader("What password do you want for your private key(s)?", terminal);
        char[] password;