I have a java app that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore to which access is protected by a passphrase.

Now the best part: I don't want to store passphrase in app, instead I want to send this passphrase via secure connection from server ... vicious circle.

What possibilities do I have? It looks like both sides need their own keypairs or symmetric key for encryption, or I need to send a passphrase via unsecured connection which anyone can sniff ;/

What platform is this app on? Android? Windows? – Mike Ounsworth

android

ps. i can deploy cert after first installation and set keystore passphrase to user encrypted password for double protec, this way client can ensure that cert was not tamped during app usage