No. trustd is part of HTTPS and app-signing security.
It runs as _trustd from /usr/libexec/trustd.
trustd's port 80 traffic surprises people, but OCSP and CRL revocation data are signed and meant to be served over plain HTTP, to avoid a chicken-and-egg problem with TLS. Blocking trustd can make HTTPS connections and app launches slower or fail, as macOS waits for revocation checks.
Facts
- Owner
- Apple (part of macOS)
- Network-related
- Yes
- Typical ports
- 80, 443
- Block it?
- Don’t block it
What it connects to
| Host | Country | Purpose |
|---|---|---|
| ocsp.apple.com and certificate authorities' OCSP/CRL servers | Various | Revocation checks and intermediate certificates |
Should you worry?
No. trustd is part of HTTPS and app-signing security. Its small connections, sometimes over plain HTTP on port 80, check whether certificates have been revoked; that data is designed to be fetched without encryption.
Frequently asked questions
What is trustd?
The macOS daemon that checks whether certificates are trusted and not revoked, for websites, apps and system services.
Why does trustd connect over HTTP?
Certificate revocation data (OCSP, CRL) is digitally signed and conventionally served over plain HTTP; encryption isn't needed to trust it.
Can I block trustd?
You shouldn't. Without revocation checks, macOS may delay or refuse HTTPS connections and app launches.