diff --git a/changelog.d/11381.doc b/changelog.d/11381.doc
new file mode 100644
index 000000000000..f99a432418a6
--- /dev/null
+++ b/changelog.d/11381.doc
@@ -0,0 +1 @@
+Fix missing quotes for wildcard domains in `federation_certificate_verification_whitelist`.
diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml
index d48c08f1d95f..3c931468aafe 100644
--- a/docs/sample_config.yaml
+++ b/docs/sample_config.yaml
@@ -647,8 +647,8 @@ retention:
 #
 #federation_certificate_verification_whitelist:
 #  - lon.example.com
-#  - *.domain.com
-#  - *.onion
+#  - "*.domain.com"
+#  - "*.onion"
 
 # List of custom certificate authorities for federation traffic.
 #
diff --git a/synapse/config/tls.py b/synapse/config/tls.py
index 6227434bac68..613faca6587e 100644
--- a/synapse/config/tls.py
+++ b/synapse/config/tls.py
@@ -263,8 +263,8 @@ def generate_config_section(
         #
         #federation_certificate_verification_whitelist:
         #  - lon.example.com
-        #  - *.domain.com
-        #  - *.onion
+        #  - "*.domain.com"
+        #  - "*.onion"
 
         # List of custom certificate authorities for federation traffic.
         #