I have a Java app. this app to be able to communicate with web server over SSL need to have valid x.509 certificate (for encryption negotiation) - certificate is in Java keystore to which access is protected by passphrase.

Now "the best part" I don't want to store pass in app and instead I want to send this pass via secure connection from server ... vicious circle

What was first chicken or egg ??? :)

What possibilities do I have ??? it looks like both sides need their own keypairs or symetric key for encryption.

Or send a passphrase via unsecured connection where every one can sniff.