title: Content security policy in ssl.conf file does not work
body: <p>Project that I'm currently working on recently got this error when accessed with firefox browser and google chrome.</p>
  <p>The error in google chrome :</p>
  <pre><code>Refused to load the image 'https://mydomain2.mysubdomain2.co.id/myimage.jpg' because it violates the following Content Security Policy directive: &quot;img-src 'self' *.mydomain1.co.id:* data: blob:&quot;.
  </code></pre>
  <p>Because of that, I edit content-security-policy in <code>/etc/httpd/conf.d/ssl.conf</code> file to allow <code>img-src</code> from every URL that contains <code>mysubdomain2.co.id</code> in the web server.</p>
  <p>Before :</p>
  <pre><code>Header always set Content-Security-Policy &quot;default-src blob: http: data: https:'unsafe-inline' 'unsafe-eval'; img-src 'self' *.mydomain1.co.id:* data: blob:;&quot;
  </code></pre>
  <p>After :</p>
  <pre><code>Header always set Content-Security-Policy &quot;default-src blob: http: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' *.mydomain1.co.id:* *.mysubdomain2.co.id* data: blob:;&quot;
  </code></pre>
  <p>I append <code>*.mysubdomain2.co.id*</code> after <code>*.mysubdomain1.co.id:*</code> in the <code>img-src</code></p>
  <p>Then I stopped the <code>httpd</code> service then start the <code>httpd</code> service again</p>
  <pre><code>sudo systemctl stop httpd.service
  sudo systemctl start httpd.service
  </code></pre>
  <p>I checked the <code>httpd.service</code> status with <code>sudo systemctl status httpd.service</code> before I stop the service, after I stop the service, and after I start the service, and the command worked as I expected. The <code>httpd.service</code> Started, stopped, and active again.</p>
  <p>But I still got this error</p>
  <pre><code>Refused to load the image 'https://mydomain2.mysubdomain2.co.id/myimage.jpg' because it violates the following Content Security Policy directive: &quot;img-src 'self' *.mydomain1.co.id:* data: blob:&quot;.
  </code></pre>
  <p>I use Apache web server.</p>
  <p>Is there something wrong in the <code>Content-Security-Policy</code>? what can I do to fix this? Any suggestion will appreciated. Thank you.</p>