Your son already automatically has Canadian citizenship based on what you said. You only need to apply for the proof of citizenship document.

Exceptions to the first generation limit

If you were born outside Canada in the second or later generation, the first generation limit to citizenship doesn’t apply to you if:

at the time of your Canadian parent’s birth or adoption, your Canadian grandparent was employed outside Canada, other than as a locally engaged person (a crown servant):

• in the Canadian Armed Forces

• with the federal public administration"

  https://www.canada.ca/en/immigration-refugees-citizenship/services/canadian-citizenship/act-changes/rules-2009-2015.html#exceptions