Thanks to Paul Farris for posting this article how to renew a self signed on a Domino Web Server:

• Copy .kyr and .sth from Server data folder to local Workstation
• Open Certsrv.nsf (Server Certificate Admin) on Server from Notes Client (not Administrator)
• Go to View Certificate Request Log
• Select Key Ring to Display
• Enter path to copied local kyr file
• Enter Password
• Select “Create Key Ring & Certificates”
• Select “Create Certificate Request”
• Copy CSR text
• Email your CSR to your SSL Certificate supplier
• When CSR returned then copy the text
• Back in Notes Client select “Install Certificate into Key Ring”
• Paste in certificate text
• Press “Merge Certificate into Key Ring” button
• Copy .kyr from local to Server Data directory
• Restart web server with “tell http restart”