default https health monitor showing down

As Jonathan said, a capture is probably your best troubleshooting tool here. Because this is SSL traffic though, you'll likely need SSLDUMP.

ssldump -k [path to server's private key] -AdNn -i 0.0 port 443 [additional filters]

You need a local copy of the web server's private key to be able to decrypt the data. The [additional filters] section is optional and would allow you to specify additional options to focus the capture (ex. "and host x.x.x.x and host x.x.x.x").

Another great tool you can use is cURL. This is a command line web browser that you can use directly from the F5 shell:

curl -k -v https://x.x.x.x

where -k tells it to ignore SSL errors, -v is verbose output, and https://x.x.x.x is the address of the web server. If you can get this request to work, then you could basically take everything that curl produces in the request, replace line feeds with "\r\n" characters, and put that in your HTTPS monitor (followed by "\r\n\r\n"). If it's by chance an SSL-related issue, the SSLDUMP should show you that.