---
title: "trustd on Mac: certificate checks and network traffic · Kilobat Guides"
url: "https://kilobat.app/guides/what-is-trustd.html"
description: "trustd checks certificates for every process on a Mac. Learn why it connects to the internet for revocation checks and why that is normal."
---

macOS processes

# What is trustd on Mac?

`trustd` checks certificates for all processes on the Mac. It can connect to the internet to find out if a certificate is still valid.

Process: `trustd` · Process: `ocspd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

## Where you see it

- `trustd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `trustd` can connect.
- `trustd` connects when you open secure websites or start apps.

## What it is

The man page says that trustd “provides services for evaluating trust in certificates for all processes on the system”. It is not for direct use.

The `ocspd` man page describes the network part. It fetches certificate revocation lists and OCSP responses, and it keeps a cache of them.

## Why it uses the network

- **Revocation checks.** To know if a certificate was revoked, macOS can ask the certificate authority.
- **A cache.** ocspd keeps answers in a cache, so most checks do not use the network again.

## Is it normal?

Yes. Small connections are usual, mostly when you visit many secure sites.

If certificate checks fail, Safari and other apps show certificate warnings. See [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html).

## See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `trustd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p trustd -P
   ```
4. Do the same for `ocspd`.

## Reduce or pause it safely

1. There is no user setting for these checks. They protect every secure connection.
2. If a company proxy blocks them, ask the administrator to allow the certificate authorities' hosts.
3. Do not quit `trustd` in Activity Monitor. It is part of macOS, and other features depend on it.

## With Kilobat

1. Open the Kilobat app list and search for `trustd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth trustd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `trustd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

## Questions

**Should I block trustd in a firewall?**

No. Then macOS cannot check if a certificate was revoked.

## Sources

- trustd(8) and ocspd(1), man page installed with macOS 27.2
- [Apple Support: Avoid fraud by using encrypted websites in Safari on Mac](https://support.apple.com/guide/safari/sfri40697/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [What is syspolicyd on Mac?](https://kilobat.app/guides/what-is-syspolicyd.html): syspolicyd is the system policy daemon.
- [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid.html): The server's certificate looks expired or not yet valid by the Mac's clock.