The message is often not correct. I replaced Thawte SHA1 certificates with SHA2 certificates, but Thawte has no ROOT certificate that is SHA2.
Therefore the message need to be something like Root certificate uses SHA1. When renewing, ensure you upgrade to an all-SHA256 chain.
But there is a problem... Thawte does not issue certificates with SHA2 root certificate. I think the message should be removed for this reason.