If you can't or don't want to use Content Delivery Networks when setting up SSL for click and open tracking, then you can setup custom SSL configuration.
Before Adding a Custom SSL configuration, you need to set up a valid link branding on your account like this:
To add a custom SSL configuration:
mailing.example.comand forward it to
HostHTTP header to
CNAME mailing.example.com proxy.example.com.
Don't validate the DNS record more than once, because after changing the CNAME, a second validation fails and the authentication stops working.
Contact SendGrid Support to enable SSL click and open tracking.