Let's Encrypt will issue you with "ECC certificates" depending on what your idea of an "ECC certificate" is.

For a generic Let's Encrypt site if you have Elliptic curve keys, the existing R3 issuing intermediate will cheerfully sign you a certificate. The certificate will be for your EC public key, but signed by the R3 intermediate using RSA.

If your reason for wanting EC is that it's less work on your server, this achieves the goal, no RSA signatures from your servers (unless you also need to serve customers that can only do RSA and need a separate setup for that).

If you want, you can enroll in a trial programme for Let's Encrypt EC issuing intermediates where E1 will sign your EC keys (if you enroll R3 still signs any RSA keys you ask for). This chains through ISRG Root X2 and then ISRG Root X1 because ISRG Root X2 is not trusted by most (any?) large trust stores today.

If you can't have RSA anywhere in the chain then yeah, Let's Encrypt can't do that for you in practice today, although it'd be nice if you explain why you'd want that.

Let's Encrypt can issue from an ECC chain, I've tweeted[1] the details on how to enable your account for that.

[1] https://twitter.com/Scott_Helme/status/1392101598852222976

What's the shortest chain-size that those free CAs can offer (assuming android>=5.0 devices)?

It would be great to have a tool somewhere that matches client handshakes & supported CAs vs server config & choice of CA chains

They're all 3 certificates long (leaf/intermediate/root) apart from Let's Encrypt which, due to their cross-signature, are 4 certificates long for ECC.