I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate  (for encryption negotiation)  - the private key is in the java keystore to which access is protected by a passphrase. 

Now the best part: I don't want to store passphrase in app, instead I want to send this passphrase via secure connection  from server ...   vicious circle.

What possibilities do I have?  It looks like both sides need their own keypairs or symmetric key for encryption, or I need to send a passphrase via unsecured connection which anyone can sniff ;/ 

I can deploy the cert after first installation and set keystore passphrase to user encrypted password for double protection, this way the client can ensure that the cert was not tampered with during app usage.

**how can my app check if it can trust given cert?**

The Authority certificate is cross-signed by IdenTrust ("DST Root CA X3" Root CA)

case: 

 - cert is in app 
 - app is deployed on device 
 - server is showing cert to app on negotiation 
 - app is comparing cert (validating by it's copy)
 - in moment when app is reading cert from file the client need to be sure that cert was not tampered  (lets assume that we do spoofing cert on server  and on client site simultaneously to enforce data exchange in app)