trustd

A burst of new secure connections, a browser opening many sites or an app syncing with many servers, means many certificates to check. After a macOS update its caches start empty, so it checks again what it had stored.

Constant high CPU from trustd is unusual. It can come from software that intercepts secure connections, such as some antivirus, VPN or network filter tools, which present their own certificates for every connection.

For a short spike, nothing: it settles once the connections are checked. For a steady one, quit apps that filter or inspect traffic and see whether it settles. If it does, that app's settings or its maker are the place to fix it.

Do not block trustd with a firewall. Apps fail to connect or open slowly without it, as the 2020 outage showed.

You will find more than one trustd. One runs as the _trustd system account, one runs as you, and some system services have their own.

1. Open Activity Monitor, choose View → All Processes and type trustd in the search field. The User column shows which account each one serves.
2. On the CPU tab, note which instance is busy. If it is the one under your name, an app you are using is making the connections.
3. Click the Network tab. A trustd that sends and receives a little, over and over, is checking revocation with a certificate server.
4. To see which servers it is talking to, open Terminal and run nettop -p trustd. Press q to quit.
5. For its own messages, run log stream --predicate 'process == "trustd"'. Repeated errors about the same certificate or server point at the app or network behind them. Press Control-C to stop.

Normal: short bursts when you open a browser, sign in to accounts, or install and open new software, then quiet. Revocation answers are cached, so the same certificate is not checked over the network again until its cached answer expires.

Worth looking into: it stays busy for a long time, or apps open slowly and fail to connect. The usual causes:

• Software that inspects secure traffic and issues its own certificate for every site, such as some antivirus, VPN and network filter tools.
• A network that blocks or slows the revocation servers, such as a captive Wi-Fi portal before you sign in, or a strict work firewall.
• A date and time on the Mac that is wrong, which makes valid certificates look expired or not yet valid. Turn on Set time and date automatically in System Settings → General → Date & Time.

Apple publishes the hosts its devices need for certificate checks in its list of network requirements for enterprise networks. They include ocsp.apple.com, ocsp2.apple.com, valid.apple.com, crl.apple.com and certs.apple.com, plus a few revocation servers run by other certificate authorities.

If you run a firewall app or manage a network with strict outbound rules, these are the connections you will see from trustd, and the ones to allow.