What is trustd on a Mac?

trustd is the macOS process that checks security certificates, the digital proof that a website, an app or a piece of software is who it claims to be. It is a normal part of macOS, it works in short bursts whenever something on the Mac makes a secure connection or opens, and you do not need to stop it. If it stays busy for a long time, the cause is usually a wrong clock, a bad network or one app that keeps asking, and each of those has a simple fix.

This post explains what trustd checks, why it shows up in a process list, and what to try when it will not settle.

What trustd does

A certificate is a file that vouches for an identity. When your Mac opens a secure web page, the address starts with https, the site shows a certificate, and something has to decide whether to believe it. That something is trustd. It looks at who issued the certificate, whether it has expired, whether it has been withdrawn, and whether the chain of trust leads back to an authority your Mac already knows.

The same checks apply to more than websites. Mail connections, app updates, signed software, the App Store and iCloud all use certificates, so trustd is asked to check them as well. Foreman, which names about 120 macOS processes in plain English, lists it as “Certificate checks” and describes it as “Checks security certificates for websites and apps.”

Most of its work is short. A check takes a moment and the answer is kept, so the same certificate does not need checking again straight away. That is why trustd sits quiet most of the time and shows brief bursts of activity.

Why trustd uses CPU

Brief activity is normal. These are the times when you are most likely to see more.

• Just after you log in or restart, when many apps and services start and each one makes secure connections.
• When you open a browser tab with many resources, such as a page that loads content from dozens of different sites.
• When you open an app for the first time, or open a freshly downloaded app.
• When a mail or calendar account syncs for the first time.

In all of these the work ends on its own. Stay patient for a few minutes before concluding anything.

When it will not settle

If trustd stays high for a long time, work through these causes in order. They go from the most common to the least.

1. The date and time are wrong. A certificate is valid between two dates, and a Mac with the wrong clock sees good certificates as not yet valid or already expired, so secure connections fail and apps try them again and again. Open System Settings, choose General, then Date & Time, and turn on setting the time and date automatically.
2. The network is poor. Some checks ask another server whether a certificate has been withdrawn, and if the network is slow or the server cannot be reached, the Mac waits and tries again. Try a different network, or turn Wi-Fi off and on. A VPN or a filter that sits between the Mac and the internet can also interfere with these checks.
3. One app keeps asking. An app that connects over and over, for example one that fails to sign in and retries, makes trustd work every time. Sort a process list by CPU and see which app is busy at the same time. How to see which app is using your Mac’s network shows how to find the app that is making the connections.
4. macOS is out of date. A stuck certificate check is sometimes a bug that a later update has fixed. Open System Settings, then General, then Software Update.
5. A restart. It clears any check that got stuck.

Do not delete keychain files or certificate folders to try to stop it. That can break sign-ins, and the files are not the cause.

Can you end trustd

You can, and there is rarely a reason to. macOS runs more than one trustd: one for the system, under the system account _trustd, and one for your own login, plus a few for other system accounts. Ending your own copy needs no password; ending the system’s needs an administrator password, and Foreman asks for it first. Either way macOS starts it again almost at once, because other parts of the system depend on it. What you get is a moment of quiet and then the same checks.

Ending it can also make things worse for a short time: secure connections that were part-way through may fail and have to be retried. If trustd is busy, finding the reason is better than ending it. That is true of nearly everything in this part of macOS, and the same is said of syspolicyd, which checks apps before they open, and XProtect, Apple’s built-in malware scanner. These three can all be at work at the same moment when you open a new app, and each of them is doing a different job.

How to look at it

For a quick look without any extra app, Terminal can show it:

top -o cpu

Look for trustd in the list and press q to leave. It only reads. top counts each processor core as 100 percent, so a figure there looks larger than the same work shown as a share of the whole Mac.

In Foreman, trustd appears as “Certificate checks”, with the real name beside it in grey: your copy under Background processes, the system’s under System processes. Sort by CPU, and leave the window open for a few minutes to see whether the work comes in short bursts or stays high. A short burst is trustd doing its job. Foreman is free for 24 hours, so a look costs nothing.

Is it malware

No. trustd is an Apple process. Malware can borrow ordinary-looking names, and you cannot tell much from a name alone, so the sure way to check is to see where the file lives. In Terminal:

ps -axo pid,user,comm | grep trustd

Each line shows the process ID, the account it runs under and the full path. Every trustd line should end in /usr/libexec/trustd, and you may also see trustdFileHelper from the same folder, which is part of it. A program called trustd anywhere else, such as somewhere in your home folder, is a reason to look closer.

The short version

Foreman lists trustd as “Certificate checks”. It checks security certificates for websites and apps, and it is normal background work that comes in bursts. If it will not settle, check the date and time, the network, and the app that keeps connecting, then update macOS and restart. Ending it does little, since macOS starts it again.