Ah yes I think that's the cause as mamba install pip 'openssl=1.1.1*' avoids it and conda install pip doesn't try to update openssl at all. I think mamba is treating aggressive_update_packages ...