I have a Java app.
To be able to communicate with web server over SSL, this app needs to have valid x.509 certificate  (for encryption negotiation) - certificate is in Java keystore to which access is protected by passphrase. 

Now "the best part" 
I don't want to store pass in app and instead I want to send this pass via secure connection  from server ...   vicious circle

What was first chicken or egg ??? :) 

What possibilities do I have ???  it looks like both sides need their own keypairs or symetric key for encryption.

Or send a passphrase via unsecured connection where every one can sniff.

	
*What platform is this app on? Android? Windows? – Mike Ounsworth*

**android**

ps. i can deploy cert after first installation and set keystore passphrase to user encrypted password  for double protect 

this way client can ensure that cert was not tamped  during app usage