I have a Java app. To be able to communicate with web server over SSL, this app needs to have valid x.509 certificate (for encryption negotiation) - certificate is in Java keystore to which access is protected by passphrase.

Now "the best part" I don't want to store pass in app and instead I want to send this pass via secure connection from server ... vicious circle

What was first chicken or egg ??? :)

What possibilities do I have ??? it looks like both sides need their own keypairs or symetric key for encryption.

Or send a passphrase via unsecured connection where every one can sniff.

What platform is this app on? Android? Windows? – Mike Ounsworth

android

ps. i can deploy cert after first installation and set keystore passphrase to user encrypted password for double protect

this way client can ensure that cert was not tamped during app usage