omfg it needs to be able to ping me?!
The dry run finally started working once I allowed ping requests on the WAN interface in the firewall, which apparently you've noticed as well. I'm in the process of copying my previous setup over to the new web server, but I think it will be fine now.
Thanks a lot everyone for all the help and staying on it too. Really appreciate it. I'll let you know how it goes actually renewing all my certificates...