One thing is that you are pointing your URL at
www.nmbs.com.au/
but the SSL certificate is registered to
nmbs.com.au/
(without the www.). That's one warning.
If you look at the page info, you see that you have 11 links/anchors pointing to the URL with the www. in it. That's more warnings.
There are 4 images with non-secure URLs.
To find all of them, in Firefox, right-click the page and look at the page info (links and media tabs).
Yes, download the Firefox web developer extension and you will find lots of cool stuff.
Until then, do as I said above... in Firefox, right-click on the page, and look at the "page info". The info for the links and images can be found in the links and media tabs.
I have the developer tools for FF, and thought I'd looked at every page's Page Info, but couldn't see those bad (http) references, I've looked again at the https site and can see them now.
They are menu links, virtuemart generated thumbnail images, internal virtuemart links etc and so not easily fixed.
I'm guessing if I'd started this site from scratch as https://... then all these generated links etc would have been https and not http.
Anyway the site is live today and I've made the decision to revert to non-SSL and tell the user he cannot collect customer's credit card data online. (PayPal option is still available)
I've set up another payment option "Credit Card by Phone" which accepts the order and then the site's owner will call the customer to get the credit card details.
It's a compromise but I just can't spend any more time on this.
Footnote: This is the most help I've had, neither joomla.org or virtuemart forums come close - thanks RocketThemers !