I have a java app that needs to be able to communicate with a web server over ssl using an client x509 certificate  (for encryption negotiation)  - the private key is in the java keystore to which access is protected by a passphrase. 

Now the best part: I don't want to store passphrase in app, instead I want to send this passphrase via secure connection  from server ...   vicious circle.

What possibilities do I have?  It looks like both sides need their own keypairs or symmetric key for encryption, or I need to send a passphrase via unsecured connection which anyone can sniff ;/ 

_What platform is this app on? Android? Windows? – Mike Ounsworth_

**Android**

P.S. I can deploy the cert after first installation and set keystore passphrase to user encrypted password for double protection, this way the client can ensure that the cert was not tampered with during app usage.