No need for debug output, "python-novaclient 3.3.1-1.2" provided the missing clue for my local machine: while I am also using Tumbleweed, I hadn't updated in a while, leaving me with somewhat ancient Openstack clients: rpm -qa | grep -e ca-certificates-suse -e python-novaclient python-novaclient-2.30.1-1.3.noarch After an update, python-novaclient-3.3.1-1.2.noarch does just fine without python-ndg-httpsclient, so this does indeed not affect Tumbleweed. What it may still affect is anything based on Cloud:OpenStack:Liberty, tough. That one still uses 2.30.1: https://build.opensuse.org/package/show/Cloud:OpenStack:Liberty/python-novaclient And neither python-novaclient nor python-keystoneclient in Cloud:OpenStack:Liberty require python-ndg-httpsclient (it's present in Cloud:OpenStack:Liberty, though). I'll build a Liberty cloud and double-check whether it accidently gets installed as a dependency of something else, but if my Liberty cloud from 3 weeks back is anything to go by that doesn't happen.