"Certificate uses a weak signature. When renewing, ensure you upgrade to SHA2"
You will only have to request a SHA2 signature the next time you order a certificate from your trusted certificate vendor. In most cases you should also be able to request a change/update of your certificates for no further charge. Please keep in mind that you will have to use the KYR tool to merge SHA2-signed stuff into your keyring.
I recommend reading this article form netcraft.com to get some further Information regarding SHA. Including a cost calculation for cracking SHA1 signed things.
"The server supports only older protocols, but not current best TLS 1.2"
That is a pretty easy one: You will only have to update your Domino Server to the most recent release. Domino supports TLS1.2 starting with 9.0.1.3 IF2.
"The server private key is too small and insecure"
You will have to create a new key with >2048bits and a new certificate/certificate request based on the new key for this. You can use some free tools like XCA or OpenSSL to create this key.
Please keep in mind that the generated keys created by tools like XCA may not be as random as other keys that are created by mouse movement / other random functions.
