I have a Java app.
To be able to communicate with web server over SSL, this app needs to have a valid X.509 certificate (for encryption negotiation) - certificate is stored in a Java keystore to which access is protected by passphrase. 

Now "the best part" 
I don't want to store pass in app and instead I want to send this pass via secure connection  from server ...   vicious circle

What was first chicken or egg ??? :) 

What possibilities do I have ???  it looks like both sides need their own keypairs or symetric key for encryption.

Or send a passphrase via unsecured connection where every one can sniff.