After StartSSL and WoSign disappeared, most free options were short trials (e.g. 90-day Comodo). For a 1-year client certificate from a publicly trusted CA, Actalis still had a free mail-cert program at the time of writing.

Apply

Certificate chain files

Verify current policy on Actalis before relying on this in production.