What is trustd on Mac?

What trustd does

trustd (/usr/libexec/trustd) is the certificate trust daemon. When Safari loads a page, an app calls an API, or the system checks a code signature, the Security framework asks trustd to:

• build a chain from the certificate up to a trusted root in the Keychain
• check expiry, name and usage
• check revocation (OCSP and Apple’s revocation lists), and cache the answer
• apply any trust settings from configuration profiles or your Keychain

There is usually one instance running as root and one per logged-in user.

Why it uses CPU or network

• Many new TLS connections at once: opening dozens of tabs, a package manager downloading hundreds of packages, a sync client starting up.
• Captive portals and broken networks: hotel Wi-Fi or a VPN that blocks some traffic can make revocation lookups hang until they time out.
• Corporate TLS inspection: a proxy that re-signs every site with its own root certificate means trustd evaluates unfamiliar chains constantly.
• A large or messy Keychain: hundreds of old certificates and custom trust settings slow down chain building.

How to make it calm down

See what it’s talking to:

nettop -P -L 1 -p trustd

Then try, in order:

1. Fix the network first. Sign in to the captive portal, or turn the VPN off briefly to see if trustd settles.
2. Look for configuration profiles you don’t recognize in System Settings › General › Device Management. Profiles can install root certificates.
3. In Keychain Access, check the System and login keychains for expired or unknown root certificates with custom trust.
4. Quit both trustd processes in Activity Monitor. They relaunch with an empty in-memory cache.
5. Restart if CPU stays high afterwards.

To see a single certificate check in detail:

/usr/bin/log stream --process trustd --level debug --style compact

When to worry

trustd itself is about as safe as it gets, but what it trusts matters. Verify the binary:

codesign -dv --verbose=2 /usr/libexec/trustd 2>&1 | grep -E 'Identifier|Authority'

Worry about a root certificate or profile you didn’t install. That lets someone inspect your HTTPS traffic. Remove it unless your employer’s IT put it there deliberately.

Seeing it in Stat Space

Stat Space’s optional latency monitor sends one ping every 10 seconds and keeps the history, so you can tell a slow or lossy network (which makes trustd wait) from a trustd problem. With Pro, “who’s phoning home” lists the remote hosts each process is talking to, including trustd’s revocation lookups, without blocking anything.