Port 2050 is the Domino console and IBM use a self signed cert to secure remote connections which you cannot change.

A quick fix would be to block connections on port 2050 from the Internet.

Or you could also segregate traffic for internal/external connections and configure two IPs on the Domino server and bind the console to the internal IP

http://www-01.ibm.com/support/docview.wss?uid=swg21200803

Or you can use a reverse proxy and expose just ports 80 & 443.

Thank you DPorter, but it is strange that I have several servers (same setup, Windows 2012R2, Domino 8.5.3 FP6 IF18) and some of them don't have this security issue...

Try a telnet on port 2050 from the internet to a a server which does not have the issue and the one that does.  It could be that the port is blocked on the servers which are not showing up with the issue.

I have disabled Telnet on all of my servers, it must be something else... Only thing that I've done is Domino reinstall on those server. After Domino reinstall, same FP, IF and JVM are installed.

But to be sure:

Connecting To xx.xx.xx.xx...Could not open connection to the host, on port [2050]: Connect failed
Connecting To xy.xy.xy.xy...Could not open connection to the host, on port [2050]: Connect failed

Thank you for your help!