1
At the time of writing, this is not possible in Thunderbird. A ticket for this is opened in 2003 and has not been resolved as of yet. However, patches with options for SHA-2 signing and AES encryption have been posted already. Please refer to bug #222179 for more information.
That bug is a 17-year tale of woe :/ It seems the change to silently use AES instead of silently use 3-DES kicked in for TB about a year ago (NSS 3.42). – mr.spuratic – 2020-02-21T16:48:28.957