trustd high CPU on Mac? Certificate checks, explained

trustd is the daemon that checks whether certificates are valid: for secure connections, app signatures, and developer identities. High CPU almost always traces to a certificate revocation check that can't complete cleanly. Here's what that means and how to fix the stubborn cases.

What trustd does

It "provides services for evaluating trust in certificates for all processes on the system": verifying TLS/SSL certificates when you connect to sites, code-signing certificates when apps launch, and developer identities. It's been in macOS since Sierra (10.12) and runs from /usr/libexec/trustd.

Why it's using high CPU

trustd performs certificate revocation checks: confirming a certificate hasn't been revoked, historically via OCSP queries to Apple's servers, with results cached locally for about 12 hours. It spikes or hangs when it can't get a clean answer:

• A slow or unreachable revocation server. In the November 2020 "OCSP" incident, Apple's ocsp.apple.com slowed down (it didn't fail), and trustd had no soft-fail timeout, so it hung, and app launches froze across many Macs.
• Corrupted local revocation data. A documented case saw trustd jump from 0% to 100% CPU, traced to a corrupted local revocation database.

Is trustd a virus?

No. The genuine /usr/libexec/trustd is SIP-protected core security. (People do post "trustd — is this malware?"; the real one, at that path, is safe.)

What to do about it

1. For transient, network-caused spikes, wait it out and restore a normal internet connection; trustd needs the network to reach Apple's revocation servers.
2. For the persistent 100% "corrupted revocation data" case: boot into Recovery and rename the valid.sqlite3 revocation file (under /private/var/protected/trustd/ on Big Sur and later) so macOS regenerates a fresh copy. This is an advanced step; back up first and follow a current, detailed walkthrough for your macOS version.
3. Don't permanently block Apple's certificate servers: that breaks revocation checking and your Mac's security.

What people get wrong

trustd is usually a symptom, not the cause: another process (a certificate check, a background network task, or a slow Apple server) is driving it. And it doesn't itself decide notarization; it evaluates the certificate chain that Gatekeeper's syspolicyd relies on.

See the process behind the spike

Certificate stalls are invisible until they freeze something. Plumby shows live CPU in your menu bar with the process named plainly, so a trustd hang reads as what it is, a certificate check waiting on the network, instead of a mystery slowdown. Measured from your Mac's real state, and nothing about your machine ever leaves it.