ZeroSSL works very well for me. I found it because it is now the default for the acme.sh client.