@pwm @KuteboiCoder @bot @amerika zerossl, but you have to go through their javashit to get a token.
From some script I found a list (so I copied it into mkcerts.sh) which I *think* is all free, but I'm not certain:
CAs[LE]=https://acme-v02.api.letsencrypt.org/directory
CAs[LEtest]=https://acme-staging-v02.api.letsencrypt.org/directory
CAs[buypass]=https://api.buypass.com/acme/directory
CAs[buypasstest]=https://api.test4.buypass.no/acme/directory
CAs[ZSSL]=https://acme.zerossl.com/v2/DV90
CAs[sslcom_rsa]=https://acme.ssl.com/sslcom-dv-rsa
CAs[sslcom_ecc]=https://acme.ssl.com/sslcom-dv-ecc
CAs[jewgle]=https://dv.acme-v02.api.pki.goog/directory
CAs[jewgletest]=https://dv.acme-v02.test-api.pki.goog/directory