--- title: "trustd: what it is, why it connects to the internet, and whether to block it · Kilobat" url: "https://kilobat.app/processes/trustd" description: "trustd checks certificates for every app on a Mac and can ask whether one was revoked. What its small traffic is, and why blocking it is a bad idea." --- Security and accounts # What is trustd? `trustd` checks certificates for all processes on the Mac. It can ask on the internet whether a certificate is still valid. Those connections go to certificate authorities such as Apple and DigiCert. Process: `trustd` · Also seen as: `ocspd` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small. Don’t block Don't block it. This can interfere with certificate trust checks, and Apple services that need validation can fail. Path `/usr/libexec/trustd` `/usr/sbin/ocspd` launchd label `com.apple.trustd` `com.apple.trustd.agent` `com.apple.ocspd` Signing identifier `com.apple.trustd` `com.apple.ocspd` ## What it is The man page says that `trustd` “provides services for evaluating trust in certificates for all processes on the system”. It is not for direct use. The `ocspd` man page describes the network part. It fetches certificate revocation lists (CRLs) and OCSP responses for Security.framework, and it keeps a cache of them. launchd starts `trustd` for the system and for each user, as `com.apple.trustd` and `com.apple.trustd.agent`. ## Why it uses the network - **Revocation checks.** To know whether a certificate was revoked, macOS can ask the certificate authority with OCSP or a CRL. - **A cache.** The `ocspd` man page says that answers are cached in `/private/var/db/crls`. Most checks don't use the network again. - **Apple's own certificates.** Apple lists `ocsp.apple.com`, `valid.apple.com` and DigiCert's OCSP and CRL hosts for certificate validation. ## How much is normal Small, short connections are usual, mostly when you visit many secure sites or open apps. Many of these checks use plain HTTP on port 80. Apple's host list shows port 80 for most OCSP and CRL hosts. The answers themselves are signed. If certificate checks fail, Safari and other apps show certificate warnings. See [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac). ## When it uses a lot, and why - **A first visit to many sites.** Each new certificate can need a check. Later visits use the cache. - **An expired cache.** When cached answers expire, the next connection asks again. The ocspd man page says that an entry is used only while it is still valid. ## Is it safe to block? Don’t block Don't block it. This can interfere with certificate trust checks, and Apple services that need validation can fail. What breaks if you block it - Some certificate revocation checks may fail or rely on cached results, depending on the service and its trust policy. - Apple says that its devices must reach the certificate validation hosts to validate the certificates of its own services. - On a company network, a proxy that blocks these checks causes certificate errors. See [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates). Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Trust policies and revocation behavior depend on the certificate and the service using it. 2. If a company proxy blocks them, ask the administrator to allow the certificate authorities' hosts. 3. Don't quit `trustd` in Activity Monitor. macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `trustd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p 'trustd' -P ``` ## With Kilobat 1. In the Kilobat app list, search for `trustd`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'trustd' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'trustd' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [ocsp.apple.com](https://kilobat.app/hosts/ocsp-apple-com): Apple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked. - [valid.apple.com](https://kilobat.app/hosts/valid-apple-com): An Apple certificate validation host. Apple lists it for every platform, on port 443, with proxy support. - [crl.apple.com](https://kilobat.app/hosts/crl-apple-com): Apple's hosts for certificate revocation lists and certificates, used to validate the certificates of Apple's services. - [ocsp.digicert.com](https://kilobat.app/hosts/digicert-ocsp): DigiCert's certificate status and revocation list hosts. Apple lists them because some of its services use DigiCert certificates. ## Questions **Should I block trustd in a firewall?** No. Blocking it can interfere with certificate trust and revocation checks. **Why does trustd use plain HTTP?** Apple lists port 80 for most of the validation hosts. OCSP responses and CRLs are signed by the certificate authority, so they can't be changed on the way. ## Sources - trustd(8) and ocspd(1), man pages installed with macOS 27.2 - launchd property lists com.apple.trustd, com.apple.trustd.agent and com.apple.ocspd, macOS 27.2 - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) - [Apple Support: Avoid fraud by using encrypted websites in Safari on Mac](https://support.apple.com/guide/safari/sfri40697/mac) Checked on 1 November 2026. ## Related - [syspolicyd](https://kilobat.app/processes/syspolicyd): Part of macOS. It runs the system policy that includes Gatekeeper, which checks new and changed apps for known malware and revoked certificates. - [timed](https://kilobat.app/processes/timed): Part of macOS. It keeps the clock correct with NTP, so it sends small requests to a time server such as time.apple.com. - [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac) - [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates) - [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid)