macOS processes

What is trustd on Mac?

trustd checks certificates for all processes on the Mac. It can connect to the internet to find out if a certificate is still valid.

Process: trustdProcess: ocspdApplies to: All current macOS versions. Seen on macOS 27.2.Checked: 29 October 2026

Where you see it

trustd is in the list in Activity Monitor › Network, in nettop or in Kilobat.
A firewall or network monitor asks if trustd can connect.
trustd connects when you open secure websites or start apps.

The man page says that trustd “provides services for evaluating trust in certificates for all processes on the system”. It is not for direct use.

The ocspd man page describes the network part. It fetches certificate revocation lists and OCSP responses, and it keeps a cache of them.

Revocation checks. To know if a certificate was revoked, macOS can ask the certificate authority.
A cache. ocspd keeps answers in a cache, so most checks do not use the network again.

Yes. Small connections are usual, mostly when you visit many secure sites.

If certificate checks fail, Safari and other apps show certificate warnings. See “This Connection Is Not Private” and certificate warnings on a Mac.

Open Activity Monitor from Applications > Utilities. Click Network.
Type trustd in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p trustd -P
```
Do the same for ocspd.

There is no user setting for these checks. They protect every secure connection.
If a company proxy blocks them, ask the administrator to allow the certificate authorities' hosts.
Do not quit trustd in Activity Monitor. It is part of macOS, and other features depend on it.

Open the Kilobat app list and search for trustd. Its row shows the live rate and the bytes it moved.
In Terminal, see the same live list. Press / and type the name to search.
```
kilobat status --watch
```
Show its traffic over one day. Names match kilobat report --summary.
```
kilobat bandwidth trustd day
```
Through MCP, an AI agent gets the same history with get_app_bandwidth and the name trustd.
The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

Should I block trustd in a firewall?

No. Then macOS cannot check if a certificate was revoked.

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.