We use http://www.digicert.com/ since we need a SAN (SubjAltName). SAN lets you do *.domain.com and domain.com

Weird surprise, Android does NOT support SAN. DigiCert gave us a root cert for free with our wildcard.