[Bug] Claude startup blocked on macOS securityd certificate evaluation (~60s delay)
Bug Description
The claude command takes 1–2 minutes to start consistently. ~1s of CPU, the rest is idle waiting.
``
$ time claude
claude 2.29s user 0.66s system 2% cpu 2:15.91 total
`
---
## Root Cause (confirmed 2026-07-05)
A stack sample of the hung process shows **2614 of 2619 samples** inside:
`
SecTrustEvaluateWithError → SecTrustEvaluateIfNecessary → securityd_send_sync_and_do
`
Claude is blocked waiting for **macOS securityd/trustd** (the system certificate-trust service) to answer a TLS certificate evaluation. The daemon takes a constant ~60 seconds to reply. This is a **local macOS daemon problem, not a network problem** — during the first ~55s of the hang the process has zero network sockets open.
Why other tools looked fine: curl uses its own CA bundle (never asks trustd), and nscurl gets cached trustd verdicts. Only Claude's in-process SecTrustEvaluate call hits the stall.
### Disproven theories (do not re-investigate)
| Theory | Test | Result |
|---|---|---|
| Timeout to 34.149.66.137 | Direct connect | 0.005s — fine (red herring) |
| MCP server connections | MCP_CONNECTION_NONBLOCKING=1 | Still 60s |
| Telemetry/Statsig | CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 | Still 66s |
| IPv6 fallback | No global v6; fails instantly | Not it |
| Apple OCSP/CRL blocked | All 4 servers reachable <0.2s | Not it |
| ASU cert trust setting | Removed → retimed → restored | Still 60s |
| Keychain on external drive | security list-keychains | Clean (login + System only) |
| Slow keychain reads | security find-generic-password | 0.017s |
Backup of ASU cert (restored, still in keychain): ~/asu-nac-cert-backup.pem
---
## Fix — Next Steps
1. **Reboot the Mac** (was already pending for Time Machine work). A wedged trustd/securityd explains the constant 60s stall.
- Alternative without reboot: sudo killall trustd securityd (both respawn automatically)
2. **Verify:** (time claude -p "reply ok") 2>&1 | tail -2 — healthy ≈ 5–8s, bugged ≈ 60s
3. If still slow after reboot: file a Claude Code bug (/bug`) — the CLI blocks startup on a synchronous SecTrustEvaluate with no timeout guard. Include the stack-sample finding above.
Environment Info
- Platform: darwin
- Terminal: Apple_Terminal
- Version: 2.1.193
- Feedback ID: 9dd77a90-01e0-4bc8-ab6b-af4fc33952c7
Errors
[]