There’s currently nothing listening on immich.arnholm.org:28080, so I’m guessing you’ve either disabled port forwarding on your router or turned off Caddy.
Either way, your setup as it stands won’t work.
By default, unless configured otherwise, Caddy tries to get a certificate using either the HTTP-01 or TLS-ALPN-01 challenge. You can read more about the different challenge types here:
The HTTP-01 challenge only works on port 80, and the TLS-ALPN-01 challenge works over TLS on port 443. Since you’re using port 28080 on your router, neither of these challenges will succeed. To make this work, you’ll either need to forward ports 80 and 443 (or just 443) to Caddy, or switch to the DNS-01 challenge instead.
For DNS-01, Caddy needs to be compiled with a module that supports your DNS provider.
It looks like you’re using custom DNS hosting, since I don’t recognize hyp.net:
$ dig +noall +answer NS arnholm.org
arnholm.org. 86400 IN NS ns1.hyp.net.
arnholm.org. 86400 IN NS ns2.hyp.net.
arnholm.org. 86400 IN NS ns3.hyp.net.
So you might have trouble finding an existing Caddy DNS module that supports it.
One workaround is to delegate _acme-challenge.immich.arnholm.org to a different DNS provider that does have a supported module. Or you could delegate _acme-challenge.arnholm.org and issue a wildcard certificate for *.arnholm.org. That’s what I do at home.
More on that approach here: