Kray,
Unfortunately, Facebook doesn't load all of it's assets over an SSL connection. While JFBConnect will load the main Javascript library over SSL if the current page is encrypted, if you use the social widgets from Facebook (Like button, comment box, Fan Box, etc), many of those will not fully load over SSL. When they are rendered on the page, they load an iFrame to Facebook's servers. That iFrame will then load user avatars and some other graphics over a non-SSL connection.
The reason this is done is because SSL requests can't be cached. For the heavy load Facebook obviously has, they have made the choice not to load that content over an SSL connection. Because of the iFrame method they are using, we have -no- control over what's loaded and they have no method to force SSL on some of those assets.
There are some widgets that likely can work over SSL without the mixed content warning, but not all of them. You may need to test what does and doesn't work and decide if the warning message is worth it or not.
Hope that explains, and sorry for the inconvenience. This is a common question, and big annoyance. We definitely hope Facebook allows SSL asset loading in the future, but we haven't heard any rumblings about that coming soon.
Thanks,
Alex