HTTP-01 must use port 80 (or port 443 after a redirect to HTTPS), is port 80 on your router/firewall being forwarded to port 8888?
Have you verified this IP address?
I can only connect to TCP port 22 (SSH) and 25 (SMTP), TCP port 80 and 443 are both filtered (not refused like with other ports). Have you checked the control panel to see if these ports are blocked?
Port 80 redirect to a jail when HAProxy is running and it handles the TLS. I thought I used port 8888 when setting my cert up initially. Is there a different test I can use?
Since HAProxy terminates TLS, the jail only needs to pass the challenge token, not to hold the cert. Two clean ways out: have HAProxy answer HTTP-01 by routing /.well-known/acme-challenge/ to the jail on 8888, or drop inbound ports altogether and use certbot's DNS-01 plugin for whichever provider holds the zone. Before rerunning, fetch that challenge path from outside once - a timeout versus a 404 tells you whether the Vultr panel or your pf anchor is eating it.