I have a java app that needs to be able to communicate with a web server over ssl using an client x509 certificate  (for encryption negotiation)  - the private key is in the java keystore to which access is protected by passphrase. 

Now the best part: I don't want to store passphrase in app, instead I want to send this passphrase via secure connection  from server ...   vicious circle.

What possibilities do I have?  It looks like both sides need their own keypairs or symmetric key for encryption, or I need to send a passphrase via unsecured connection which anyone can sniff ;/