I have a java app that needs to be able to communicate with a web server over ssl using an client x509 certificate  (for encryption negotiation)  - the private key is in the java keystore to which access is protected by a passphrase. 

Now the best part: I don't want to store passphrase in app, instead I want to send this passphrase via secure connection  from server ...   vicious circle.

What possibilities do I have?  It looks like both sides need their own keypairs or symmetric key for encryption, or I need to send a passphrase via unsecured connection which anyone can sniff ;/ 

What platform is this app on? Android? Windows? – Mike Ounsworth

android

ps. i can deploy cert after first installation and set keystore passphrase to user encrypted password for double protec, this way client can ensure that cert was not tamped during app usage