We generate certificates that are intended to be used for server authentication in a couple of places:

- `bin/elasticsearch-certutil http` command  ( See `CertGenUtils.generateSignedCertificate` in `HttpCertificateCommand` )
- TLS auto-configuraion for node startup ( see [`AutoConfigureNode`](https://github.com/elastic/elasticsearch/blob/814f7f9f52cb8c05db6465b9bfc818ea5d76c575/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L454) )

In these cases we know that the certificate is meant to be used for server authentication, so we can set Extended Key Usage extension to `1.3.6.1.5.5.7.3.1`
x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java
terminal.errorPrintln("Failed to read from file " + path);
            terminal.errorPrintln(e.toString());
            return FileType.UNRECOGNIZED;
        }
        
        try (Stream<String> lines = Files.lines(path, StandardCharsets.UTF_8)) {
            final List<FileType> types = lines.filter(s -> s.startsWith("-----BEGIN")).map(s -> {
                if (s.contains("BEGIN CERTIFICATE")) {
                    return FileType.PEM_CERT;
                } else if (s.contains("PRIVATE KEY")) {
                    return FileType.PEM_KEY;
                } else {
                    return null;
                }
            }).filter(ft -> ft != null).collect(Collectors.toList());
            switch (types.size()) {
                case 0:
                    
                    return FileType.UNRECOGNIZED;
                case 1:
                    return types.get(0);
                default:
                    if (types.contains(FileType.PEM_KEY)) {
                        
                        terminal.errorPrintln(
                            "Cannot determine a type for the PEM file "
                                + path
                                + " because it contains: ["
                                + Strings.collectionToCommaDelimitedString(types)
                                + "]"