Hacker News Reader

That's obsolete. macOS now uses ocsp2.apple.com.

The process is "trustd".

Thanks. Does that depend on macOS version? Better to block both I guess.

> Does that depend on macOS version?

Yes, though I couldn't say offhand when exactly it changed.

I've checked my DNS logs and there hasn't been a single hit against ocsp.apple.com over the last year, but around 20-30 hits for ocsp2.apple.com per day per device. (iphone, macMini, macbook)

Just blocking ocsp2.apple.com is probably fine if you're running anything recent-ish.

Block ocsp3.apple.com while you're at it.

And ocsp4. And 5. Block them all!

Does Little Snitch support regex? Perhaps it should be `ocsp\d*\.apple\.com`

Reply on news.ycombinator.com