Content Security Policy for self subdomains

You need to explicitly add them with fully qualified domains:

default-src 'self' sub1.example.com sub2.example.com

Or with wildcards:

default-src 'self' *.example.com