trustd — the process that checks certificates before you trust anything

Last updated: 2026-07-30

What it is

trustd is the system's trust evaluation service. Whenever any part of macOS needs to answer the question *"is this certificate valid, and should I trust it?"*, that question is handed to trustd.

Two situations account for nearly all of its work. The first is TLS: every time your Mac opens an HTTPS connection, the server presents a certificate chain, and something has to verify that the chain is well-formed, that it terminates in a root your Mac trusts, and that none of the links have expired or been revoked. The second is code signing: when you launch an application, the signature on that application is checked against the developer certificate that produced it.

One correction to a widespread claim, though: this does not mean a network request per page you open. Most of the validation is local. A request only goes out when the answer is not already cached, not carried in the certificate chain, and not supplied by the server alongside the connection.

Because both of those things happen constantly, trustd is one of the most consistently active processes on a Mac — and one of the least visible, because when it works correctly nothing happens.

Why it talks to the network

Certificate validation is mostly local arithmetic. The part that is not local is revocation checking.

A certificate carries an expiry date, but it can also be revoked before that date — because the private key leaked, or because a developer account was terminated for distributing malware. Nothing in the certificate itself can announce this after the fact, so the checking party has to ask the issuer. That is what the connections to ocsp.apple.com and similar endpoints are.

Apple changed how this works after the November 2020 incident, in which the OCSP responder became slow rather than unavailable and applications across the world hung on launch while waiting for it. The checks now use an encrypted protocol, are more aggressively cached, and fail fast rather than blocking indefinitely.

How much traffic is normal

Tiny. A revocation query and its response are on the order of a few hundred bytes to a couple of kilobytes, and results are cached, so repeated launches of the same app do not produce repeated queries.

Across a normal day trustd's total is comfortably under a megabyte for most people, and even a heavy day of installing new software rarely pushes it past a few megabytes. Like mDNSResponder, it can show a lot of *connections* while moving almost no *data* — and the connection count is the number people usually notice first.

If you ever see trustd attributed with a genuinely large volume, that is unusual enough to be worth investigating, though in practice the far more common anomaly is trustd appearing to hang rather than trustd using bandwidth.

Can you turn it off

No. This is a keep process, and one of the ones where the reasoning is unusually clear-cut.

trustd is not optional infrastructure that happens to be enabled by default; it is the component that decides whether the code you are about to run and the server you are about to send data to are what they claim to be. Killing it does not make your Mac faster or more private in any meaningful sense. launchd will restart it anyway.

Blocking its network access in a firewall is technically possible and occasionally recommended in privacy guides. Understand the trade: you save a negligible amount of bandwidth, and in exchange your Mac loses the ability to learn that a certificate has been revoked. Apple does provide a supported way to disable revocation checking for people who genuinely need it, which is preferable to blocking the process at the network layer, where the failure modes are less predictable.

Seeing what it actually used

trustd is a good example of why connection counts mislead. It opens a great many short-lived connections and moves almost nothing through them, so any tool that ranks processes by activity will put it near the top while any tool that ranks by bytes will barely show it.

Bytetally counts upload and download per process, separately and over time, which is what lets you confirm the boring truth about trustd: constantly busy, essentially free. And if it ever stops being free, you will have the history to see exactly when that changed.

Related processes

Common questions