How to Fix ‘Trustd High CPU Usage’ on Mac

Opening Activity Monitor on your Mac to investigate sluggish responsiveness, loud system fan activity, or rapid battery drain only to find a system process named trustd consuming 80% to 100% or more of CPU capacity indicates a certificate evaluation deadlock. In the macOS architecture, trustd is Apple’s core security daemon responsible for checking certificate validity, verifying Secure Sockets Layer (SSL) and Transport Layer Security (TLS) handshakes, querying Online Certificate Status Protocol (OCSP) responders, and parsing Certificate Revocation Lists (CRLs). When local certificate databases become corrupted, or when network firewall rules intercept OCSP queries, trustd enters an infinite validation retry loop that consumes significant processor resources. This guide walks you through diagnosing trust evaluation hangs and clearing corrupted certificate caches on macOS.

Why Does trustd Spike CPU Resources?

The trustd daemon operates automatically in the background whenever applications make secure outbound network requests, verify code signatures, or connect to Apple cloud services. Common causes of high CPU utilisation include:

• Corrupted Local Trust Caches (sqlite databases): Damaged trust databases located inside the user or system security library that prevent fast index lookups.
• Network OCSP and CRL Validation Timeouts: Enterprise firewalls, proxy servers, or captive Wi-Fi portals blocking outbound HTTP queries to Apple’s certificate revocation servers (such as ocsp.apple.com).
• Corrupted Keychain Certificates: Expired, self-signed, or duplicate root certificates installed by VPN clients, developer certificates, or corporate SSL inspection tools.
• Security Daemon Lock Contention: Rapid parallel connection requests from third-party synchronization tools or browsers overwhelming the local security sub-system.

Method 1: Reset User Certificate and Trust Caches

Clearing temporary trust evaluation caches forces macOS to rebuild clean SQLite index databases without affecting stored passwords.

1. Open Terminal from Applications > Utilities (or press Command + Space and search for Terminal).
2. Execute the following command to remove user-level trust caches:

   rm -rf ~/Library/Caches/com.apple.trustd/

3. Next, clear the user’s temporary security databases:

   rm -rf ~/Library/Keychains/*/ocspcache.sqlite3*

4. Restart the trustd daemon to apply the clean state:

   killall trustd

5. macOS will immediately relaunch trustd in a clean state with minimal CPU overhead.

Method 2: Remove System-Level CRL and OCSP Caches

If system-wide services trigger certificate verification hangs, purge the root-level revocation caches using administrative privileges.

1. In Terminal, execute the following command:

   sudo rm -f /var/db/crls/*cache.db*

2. Enter your macOS administrator password when prompted and press Enter.
3. Restart your Mac by navigating to Apple menu > Restart.
4. Upon reboot, the operating system repopulates fresh revocation databases directly from Apple’s verification servers.

Method 3: Audit Keychain Access for Untrusted or Expired Certificates

Invalid custom certificates installed in your user or system keychain frequently force the daemon to cycle through failed cryptographic checks.

1. Press Command + Space, type Keychain Access, and press Enter.
2. In the left sidebar, select login under Default Keychains and click the Certificates tab at the top.
3. Look for any certificates displayed with a red X icon, indicating expired or untrusted status.
4. If an old developer or unused self-signed certificate is invalid, right-click it and choose Delete.
5. Select System in the left sidebar and inspect the Certificates tab for duplicate entries or broken intermediate root certificates.

Method 4: Verify Outbound Connectivity to Apple OCSP Servers

If your Mac sits behind a corporate proxy or custom DNS server, verify that certificate queries are not being blocked.

1. In Terminal, test connectivity to Apple’s revocation infrastructure:

   curl -I -s https://ocsp.apple.com | head -n 5

2. If the command hangs or returns connection refused, your network router or VPN configuration is blocking necessary verification calls.
3. Temporarily disconnect from your VPN client or configure DNS settings to public resolvers (such as 1.1.1.1 or 8.8.8.8) in System Settings > Network.

Overview of trustd Diagnostic Steps

Action	Target Directory / Tool	Expected Resolution
Clear User Caches	~/Library/Caches/com.apple.trustd/	Flushes broken user-level SQLite session cache
Purge System CRL DB	/var/db/crls/	Rebuilds global certificate revocation lists
Audit Keychain	Keychain Access GUI	Removes expired and conflicting root certs
Verify OCSP Reachability	ocsp.apple.com via curl	Eliminates network packet timeout loops

Clearing these damaged certificate caches and verifying network access resolves trustd CPU spikes and restores normal macOS system performance.