Image URLs require their own certificate. If you're looking to fully secure all content on a landing page or within your Marketing Cloud account, you will need to purchase 2 SSL SKUs from your Account Executive. One SSL SKU to cover the landing page URL and the second SSL SKU to cover the image URLs that are used on the landing page.
Salesforce Marketing Cloud does not support Wildcard certificates. We only accept customer supplied certificates that are either single domain or SAN certificates. An SSL SKU is still required.
there is used acronym:
SSL SKU. What does this
Another thing: is it possible to use free (eg let's encrypt) certificate to handle this certificate requirement?