diff -u b/core/includes/install.core.inc b/core/includes/install.core.inc
--- b/core/includes/install.core.inc
+++ b/core/includes/install.core.inc
@@ -133,6 +133,9 @@
     // The last task that was completed during the previous installation
     // request.
     'completed_task' => NULL,
+    // This becomes TRUE only when a valid config directory is created or
+    // detected.
+    'config_verified' => FALSE,
     // This becomes TRUE only when Drupal's system module is installed.
     'database_tables_exist' => FALSE,
     // This becomes TRUE only when a valid database connection can be
@@ -302,7 +305,8 @@
 
   // Check existing settings.php.
   $install_state['database_verified'] = install_verify_database_settings();
-  $install_state['settings_verified'] = install_ensure_config_directory() && $install_state['database_verified'];
+  $install_state['config_verified'] = install_ensure_config_directory();
+  $install_state['settings_verified'] = $install_state['config_verified'] && $install_state['database_verified'];
 
   if ($install_state['database_verified']) {
     // Initialize the database system. Note that the connection
@@ -795,11 +799,13 @@
   // Install system.module.
   drupal_install_system();
 
-  // Ensure that all directories created by the installer have appropriate
-  // .htaccess files. This is done here because the function relies on
-  // system.module in order to work, and because at this point in the installer
-  // all the necessary directories (including the config directory) have been
-  // created.
+  // Call file_ensure_htaccess() to ensure that all of Drupal's standard
+  // directories (e.g., the public files directory and config directory) have
+  // appropriate .htaccess files. These directories will have already been
+  // created by this point in the installer, since Drupal creates them during
+  // the install_verify_requirements() task. Note that we cannot call
+  // file_ensure_access() any earlier than this, since it relies on
+  // system.module in order to work.
   file_ensure_htaccess();
 
   // Enable the user module so that sessions can be recorded during the
@@ -1032,11 +1038,11 @@
     'required' => TRUE,
   );
 
-  // Create a default config directory, unless someone already defined one in
-  // settings.php.
+  // Add the config directory to settings.php. If someone already defined one
+  // in the existing settings.php, use that; otherwise, use a randomized
+  // directory name.
   $settings['config_directory_name'] = array(
-    // This duplicates drupal_get_token() because that function can't work yet.
-    'value'     => $config_directory_name ? $config_directory_name : 'config_' . drupal_hmac_base64('', session_id() . drupal_hash_base64(drupal_random_bytes(55)) . $settings['drupal_hash_salt']['value']),
+    'value'     => $config_directory_name ? $config_directory_name : 'config_' . drupal_hash_base64(drupal_random_bytes(55)),
     'required'  => TRUE,
   );
 
@@ -1057,6 +1063,8 @@
   // for the last completed task, now that we have a valid connection. This
   // last step is important since we want to trigger an error if the new
   // database already has Drupal installed.
+  $install_state['settings_verified'] = TRUE;
+  $install_state['config_verified'] = TRUE;
   $install_state['database_verified'] = TRUE;
   $install_state['completed_task'] = install_verify_completed_task();
 }
diff -u b/core/modules/system/system.install b/core/modules/system/system.install
--- b/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -316,11 +316,20 @@
     $directories[] = variable_get('file_temporary_path', file_directory_temp());
   }
 
-  // Check the config directory, unless it is not yet defined in settings.php.
-  // (In that case, the installer will create a valid config directory later.)
-  if ($phase != 'install' || !empty($GLOBALS['config_directory_name'])) {
+  // Check the config directory if it is defined in settings.php. If it isn't
+  // defined, the installer will create a valid config directory later, but
+  // during runtime we must always display an error.
+  if (!empty($GLOBALS['config_directory_name'])) {
     $directories[] = config_get_config_directory();
   }
+  elseif ($phase != 'install') {
+    $requirements['config directory'] = array(
+      'title' => $t('Configuration directory'),
+      'value' => $t('Not present'),
+      'description' => $t('Your %file file must define the $config_directory_name variable as the name of a directory in which configuration files can be written.', array('%file' => conf_path() . '/settings.php')),
+      'severity' => REQUIREMENT_ERROR,
+    );
+  }
 
   $requirements['file system'] = array(
     'title' => $t('File system'),