diff --git a/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/LazySessionIdGenerator.java b/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/LazySessionIdGenerator.java
new file mode 100644
index 0000000000..956f13b62d
--- /dev/null
+++ b/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/LazySessionIdGenerator.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2012-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.context.embedded.tomcat;
+
+import org.apache.catalina.LifecycleException;
+import org.apache.catalina.LifecycleState;
+import org.apache.catalina.util.StandardSessionIdGenerator;
+
+/**
+ * A specialization of {@link StandardSessionIdGenerator} that initializes
+ * {@code SecureRandom} lazily.
+ *
+ * @author Andy Wilkinson
+ */
+class LazySessionIdGenerator extends StandardSessionIdGenerator {
+
+	@Override
+	protected void startInternal() throws LifecycleException {
+		setState(LifecycleState.STARTING);
+	}
+
+}
diff --git a/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java b/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java
index 22b581f187..c78714eca7 100644
--- a/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java
+++ b/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java
@@ -437,6 +437,7 @@ public class TomcatEmbeddedServletContainerFactory
 		else {
 			context.addLifecycleListener(new DisablePersistSessionListener());
 		}
+		context.addLifecycleListener(new LazySessionIdGeneratorListener());
 	}
 
 	private void configurePersistSession(Manager manager) {
@@ -807,4 +808,19 @@ public class TomcatEmbeddedServletContainerFactory
 
 	}
 
+	private static class LazySessionIdGeneratorListener implements LifecycleListener {
+
+		@Override
+		public void lifecycleEvent(LifecycleEvent event) {
+			if (event.getType().equals(Lifecycle.START_EVENT)) {
+				Context context = (Context) event.getLifecycle();
+				Manager manager = context.getManager();
+				if (manager != null) {
+					manager.setSessionIdGenerator(new LazySessionIdGenerator());
+				}
+			}
+		}
+
+	}
+
 }