Security and accounts

What is trustd?

trustd checks certificates for all processes on the Mac. It can ask on the internet whether a certificate is still valid. Those connections go to certificate authorities such as Apple and DigiCert.

Process: trustdAlso seen as: ocspdMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small.

Don’t block

Don't block it. This can interfere with certificate trust checks, and Apple services that need validation can fail.

Path: /usr/libexec/trustd /usr/sbin/ocspd
launchd label: com.apple.trustd com.apple.trustd.agent com.apple.ocspd
Signing identifier: com.apple.trustd com.apple.ocspd

What it is

The man page says that trustd “provides services for evaluating trust in certificates for all processes on the system”. It is not for direct use.

The ocspd man page describes the network part. It fetches certificate revocation lists (CRLs) and OCSP responses for Security.framework, and it keeps a cache of them.

launchd starts trustd for the system and for each user, as com.apple.trustd and com.apple.trustd.agent.

Why it uses the network

Revocation checks. To know whether a certificate was revoked, macOS can ask the certificate authority with OCSP or a CRL.
A cache. The ocspd man page says that answers are cached in /private/var/db/crls. Most checks don't use the network again.
Apple's own certificates. Apple lists ocsp.apple.com, valid.apple.com and DigiCert's OCSP and CRL hosts for certificate validation.

How much is normal

Small, short connections are usual, mostly when you visit many secure sites or open apps.

Many of these checks use plain HTTP on port 80. Apple's host list shows port 80 for most OCSP and CRL hosts. The answers themselves are signed.

If certificate checks fail, Safari and other apps show certificate warnings. See “This Connection Is Not Private” and certificate warnings on a Mac.

When it uses a lot, and why

A first visit to many sites. Each new certificate can need a check. Later visits use the cache.
An expired cache. When cached answers expire, the next connection asks again. The ocspd man page says that an entry is used only while it is still valid.

Is it safe to block?

Don’t block

Don't block it. This can interfere with certificate trust checks, and Apple services that need validation can fail.

What breaks if you block it

Some certificate revocation checks may fail or rely on cached results, depending on the service and its trust policy.
Apple says that its devices must reach the certificate validation hosts to validate the certificates of its own services.
On a company network, a proxy that blocks these checks causes certificate errors. See Corporate proxy certificates break Terminal tools on a Mac.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

Trust policies and revocation behavior depend on the certificate and the service using it.
If a company proxy blocks them, ask the administrator to allow the certificate authorities' hosts.
Don't quit trustd in Activity Monitor. macOS starts it again.

See how much it uses

Open Activity Monitor from Applications › Utilities. Click Network.
Type trustd in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p 'trustd' -P
```

With Kilobat

In the Kilobat app list, search for trustd. Its row shows the live rate and what it moved today.
In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.
In Terminal, ask the same question. Add --json for scripts and agents.
```
kilobat explain 'trustd'
```
Show its traffic over one day.
```
kilobat bandwidth 'trustd' day
```
Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

ocsp.apple.comApple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked.Apple →valid.apple.comAn Apple certificate validation host. Apple lists it for every platform, on port 443, with proxy support.Apple →crl.apple.comApple's hosts for certificate revocation lists and certificates, used to validate the certificates of Apple's services.Apple →ocsp.digicert.comDigiCert's certificate status and revocation list hosts. Apple lists them because some of its services use DigiCert certificates.DigiCert →

Questions

Should I block trustd in a firewall?

No. Blocking it can interfere with certificate trust and revocation checks.

Why does trustd use plain HTTP?

Apple lists port 80 for most of the validation hosts. OCSP responses and CRLs are signed by the certificate authority, so they can't be changed on the way.

Sources

trustd(8) and ocspd(1), man pages installed with macOS 27.2
launchd property lists com.apple.trustd, com.apple.trustd.agent and com.apple.ocspd, macOS 27.2
Apple Support: Use Apple products on enterprise networks
Apple Support: Avoid fraud by using encrypted websites in Safari on Mac

Checked on 1 November 2026.