The best way is to purchase a certificate for your ASA and install it there.
If you can't or don't want to do that, then you should create a well-formed self-signed certificate on the ASA. You should ensure your have a good 2048-bit RSA key (or create a new one when you start).
If you use a fully qualified domain name (FQDN) for the VPN users to access the ASA that should be the Common Name (CN) in the certificate. That addresses item #1 in the warning.
Your clients will need to download and install the certificate into their trusted root CA store. You can do this by browsing to the web portal and using your browser tools to copy the ASA's SSL certificate to a local file and then importing it, overriding the default location and choosing the Trusted root CA store. That addresses item #2.
Item #3 is also due to how the self-signed certificate was created. If you follow the configuration guide you should have a well-formed certificate and not get that error.
