Okay, then running Certbot on the VM that handles port 80 should have worked. Is that the VM you ran it on?
Note that places the cert on that VM. So, you'll need to copy it to the other.
To avoid that, use mod_md with the tls-alpn challenge on port 443. Setup mod_md on the Apache VM for that port.
Just curious ... what benefit do you get from splitting port 80 to a separate VM than port 443?