We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
}
    /**
     * Resolve a filename as a Path (suppressing forbidden APIs).
     * Protected so tests can map String path-names to real path objects
     */
    @SuppressForbidden(reason = "CLI tool resolves files against working directory")
    protected Path resolvePath(String name) {
        return PathUtils.get(name).normalize().toAbsolutePath();
    }
    private void writeZip(Path file, char[] password, CertificateTool.CAInfo caInfo, List<CertOptions> certificates, Environment env)
        throws UserException {
        if (Files.exists(file)) {
            throw new UserException(ExitCodes.IO_ERROR, "Output file '" + file + "' already exists");
        }
        boolean success = false;
        try {
            try (
                OutputStream fileStream = Files.newOutputStream(file, StandardOpenOption.CREATE_NEW);
                ZipOutputStream zipStream = new ZipOutputStream(fileStream, StandardCharsets.UTF_8)
            ) {
                createZipDirectory(zipStream, "elasticsearch");
                if (certificates.size() == 1) {
                    writeCertificateAndKeyDetails(zipStream, "elasticsearch", certificates.get(0), caInfo, password, env);
                } else {
                    for (CertOptions cert : certificates) {
                        final String dirName = "elasticsearch/" + cert.name;
                        createZipDirectory(zipStream, dirName);
                        writeCertificateAndKeyDetails(zipStream, dirName, cert, caInfo, password, env);
                    }
                }