I have problem where clients are reluctant to host their websites / email with me due to them getting warnings about untrusted security certificates in Thunderbird.

I've recently switched from another hosting company which I had the same problem with (although that wasn't the reason why I switched).

It's never bothered me personally, but clients do seem to be bothered about it. I checked with my hosts to see what they said about it and here's how they replied:

the SSL certificate install on the servers hostname is self signed SSL certificate which comes free with cpanel system and it is installed with the servers hostname and this self signed SSL certificate is non trusted.

so please have your client to ignore that warning in thunderbird

Does this sound like a legitimate reason? Or does it just sound like the do indeed have an untrusted certificate, but are just telling people 'not to worry about it'.

What do you think?

Does this sound like a legitimate reason? Or does it just sound like the do indeed have an untrusted certificate

Yep it's correct.

But why are you using SSL any way?

Ahh right! Correct as in, they're not trying to pull the wool over my eyes?

As for SSL, I have no idea! Could this be something to do with Thunderbird or my host? As I (and my client) have just let Thunderbird configure it automatically, although I did have to adjust the user name in order to get it to log in properly

Nope Plesk, WHM and cPanel come with self-signed SSL certs for users to login using HTTPS for site management.

And as they did the auto config Thunderbird will have "Use secure login" set so it will be using SPA for the login

Ohhh right! Do you think I should tick another option under the Security Settings option? Here's what I'm using now (not sure what my client had it set to).

Select None if they don't want to add the certificate exception, You have probably wllowed the exception already.

Ah okay thanks. Yes I think in my case I just clicked the 'confirm exception' option.

The problem I'm having at the minute is thinking of how to explain this to future concerned clients, in a way that they might understand.

I basically said to this client that the security certificate wasn't in Thunderbirds list of certificates.

But I get the impression that if I just tell people to click 'confirm' or select no security' then they might just think I'm basically saying

"I'm not sure if it's secure and I'm not gonna do anything about it"

I don't suppose there's anyway of explaining it in terms that they might understand though!

The communications are secure with ANY SSL and any kind certificate all you are doing "Yes I trust this certificate provider".

Acceptance for the 'Root' certificate from issued by Thawte and Verisign are built in to the browsers, and by adding the "exception" you are simply accepting that provider.
It does not "weaken" browser security or have other implications.