For that to work you need to be forwarding external port 80 on your router to port 80 on your hass. Port 8123 is used by the hass UI. The “http-01” tells certbot to listen on port 80.
Certbot is not hass. It is a different app you are running to authenticate and install a certificate from LetsEncrypt. Yes hass runs on port 8123 by default but when you fire up certbot with the command you are using it is listening on port 80 by default. Certbot can only listen on either port 80 or port 443 depending on the options you give it in the command line. Personally I forward external port 80 to my hass pi always. Certbot is the only app/service that even listens on my pi on port 80 so when certbot is not actually running nothing listens on that port. Hass is always listening on port 8123 so there is not conflict since they use separate ports. Does that make it a bit clearer?
My hass listens on the default port 8123. I forward external port 8123 on my router to port 8123 on my Pi. I can then access hass from external internet by going to https://:8123. If you add the port number 8123 to your URL there is not need to forward 443 -> 8123.
Here is what my config looks like to enable https. Note that I"m linking directly to the cert files in the location that certbot places them. To do that you have to change the permissions on those folders to allow the user that hass runs as to be able to read them. Other people just copy the cert files into the same folder that the hass config files are in which can simplify this. The only catch on that is that when you certs are updated you will have to copy them again. There are forum posts I’ve seen around here showing how others have dealt with that. I’m not sure if you are using Win or Linux and how comfortable you are with permissions, etc.