trustd decides whether certificates can be trusted, for every app on your Mac: the certificates behind websites, signed software and more, including whether one has been revoked; it's part of macOS and safe. Brief CPU and network use is normal, and if it's constantly busy, look for a VPN, proxy or profile that installs its own certificates.
Last reviewed · 2 sources
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /usr/libexec/trustd |
|---|---|
| Runs as | your user account and macOS system accounts |
| Signed by | Apple (Software Signing), identifier com.apple.trustd |
| Note | Several copies were running: one for the user, others for system accounts such as _mxappservice. |
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL/TLS certificate for a website, validate a code signature, or check a developer identity, trustd performs the cryptographic validation against the system's certificate trust store and any user-installed certificates.
High CPU or network usage when validating certificates for many simultaneous connections
SSL errors in Safari or other apps when trustd cannot reach OCSP responders
Slow application launches due to code signature verification delays
Certificate trust failures after system clock changes or expired root certificates
Go to System Settings > General > Date & Time and ensure 'Set date and time automatically' is enabled. Incorrect system time causes certificate validation failures because certificates have validity periods that depend on accurate timestamps.
Open Keychain Access (on recent macOS it's in /System/Library/CoreServices/Applications; Spotlight finds it), select the System keychain and click Certificates. A certificate you don't recognize that is set to Always Trust, often added by a VPN, proxy or content filter, changes how trustd judges websites. Remove it only if you know which tool added it and no longer use that tool.
trustd contacts ocsp.apple.com and other OCSP responders to check certificate revocation status. If your network blocks these connections (corporate firewall, VPN, or DNS filter), trustd will time out and cause delays. Ensure ocsp.apple.com is accessible.
Apple periodically updates the trusted root certificate store through macOS updates. If you're seeing trust failures with well-known sites, check System Settings > General > Software Update for pending updates that may include certificate store refreshes.
trustd making occasional network requests and using brief CPU spikes during certificate validation is completely normal. Look closer if trustd is constantly making rapid connections to hosts you don't recognize: a proxy, VPN or filter that intercepts HTTPS is the usual cause, and a certificate it installed (step 2) is where to start.
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers ...
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the networ...
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications....
Trend Micro described XCSSET in August 2020: it inserts code into local Xcode projects so the payloa...
Kandji found Cuckoo in 2024 in a universal app named DumpMediaSpotifyMusicConverter, then in convert...
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
trustd evaluates whether digital certificates are trustworthy. Every time you visit an HTTPS website, open a signed application, or install software, trustd checks the certificate chain to verify identity and integrity. It contacts OCSP (Online Certificate Status Protocol) servers to check whether certificates have been revoked.
trustd connects to OCSP responders (like ocsp.apple.com) to verify that certificates haven't been revoked. This happens when you visit websites, launch signed apps, or install updates. The network usage is normal security behavior — it's your Mac checking that the things it's connecting to are legitimately who they claim to be.
Yes. trustd is a core Apple security daemon that protects you from fraudulent certificates and compromised connections. It is code-signed by Apple, runs as several copies started by launchd (one for your user account, others for macOS system accounts), and lives in /usr/libexec, which System Integrity Protection guards. It plays a critical role in macOS's security architecture.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser