# \[docs request\]: server ... ssl check == layer6 check passed but server ... ssl check no-check-ssl == layer4 check passed

**URL:** <https://discourse.haproxy.org/t/docs-request-server-ssl-check-layer6-check-passed-but-server-ssl-check-no-check-ssl-layer4-check-passed/9301>\
**Category:** Help!\
**Created:** [December 8, 2023, 12:28am UTC](https://discourse.haproxy.org/t/docs-request-server-ssl-check-layer6-check-passed-but-server-ssl-check-no-check-ssl-layer4-check-passed/9301 "2023-12-08T00:28:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElijahLynn](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/elijahlynn/32/2128_2.png) [@ElijahLynn](https://discourse.haproxy.org/u/ElijahLynn)\
**Post date:** [December 8, 2023, 12:28am UTC](https://discourse.haproxy.org/t/docs-request-server-ssl-check-layer6-check-passed-but-server-ssl-check-no-check-ssl-layer4-check-passed/9301/1 "2023-12-08T00:28:52Z")

</div>

Hi, I’m looking for docs. What is layer 6? The below tests are in a backend with `mode tcp`. I’m _assuming_ that layer 6 means TCP but am not familiar with TCP being at layer 6. I also don’t see any logs at INFO level or in debug (-d) mode showing the health check requests to confirm. These messages are from the /stats page.

- `server ... ssl check` == `L6OK`/`Layer6 check passed` (this is the same if I use `server ... ssl check check-ssl`, can’t use just `ssl check-ssl` because if I do then no health checks on any layers work))
- `server ... ssl check no-check-ssl` == `L4OK`/`Layer4 check passed`

---

<div class="post-metadata">

**Author:** ![ElijahLynn](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/elijahlynn/32/2128_2.png) [@ElijahLynn](https://discourse.haproxy.org/u/ElijahLynn)\
**Post date:** [December 8, 2023, 8:01pm UTC](https://discourse.haproxy.org/t/docs-request-server-ssl-check-layer6-check-passed-but-server-ssl-check-no-check-ssl-layer4-check-passed/9301/2 "2023-12-08T20:01:40Z")

</div>

Well, Wikipedia says:

> [Transport Layer Security](https://en.wikipedia.org/wiki/Transport_Layer_Security) (TLS) does not strictly fit inside the model either. It contains characteristics of the transport and presentation layers.

And the table suggests TLS is layer 6:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/2/2d4e8d058e1aa16a609f0c19e1fdae20f80f029a.png)

Then it links to this answer by Tom Leek “[What layer is TLS?](https://security.stackexchange.com/a/93338/55823)” which says:

> - SSL/TLS organizes data as records, that may contain, in particular, handshake messages. Handshake messages look like layer 5. This would put SSL/TLS at layer 6 or 7.

and

> Thus, in the OSI model, SSL/TLS must be in layer 6 or 7, and, _at the same time_ , in layer 4 or below. The conclusion is unescapable: the OSI model does not work with SSL/TLS. TLS is not in any layer.

#TodayILearned

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [December 11, 2023, 10:20am UTC](https://discourse.haproxy.org/t/docs-request-server-ssl-check-layer6-check-passed-but-server-ssl-check-no-check-ssl-layer4-check-passed/9301/3 "2023-12-11T10:20:53Z")

</div>

Yes, SSL/TLS is considered Layer 6 in haproxy.