What authentication method do you have set for the outgoing server (SMTP) you are using to send mail (not the authentication for the incoming account) Do you have this issue when you disable outgoing mail scanning in your antivirus? Fundamentally Thunderbird does not use windows security, but some antivirus product switch Thunderbird to use the windows certificate store, reducing security, so their un-trusted certificates can be installed automatically. (Thunderbird requires the user to manually add un-trusted certificates. Microsoft allow software (including malware as it is just another program) to use programming to update the windows store. But regardless of that the authentication method for o365 should be oauth20 not something requiring certificates.