... it is safe to send all kind of data between server and client?
No. You just blindly assumed that you've send your key to the right server and that you get a key from the right server back. But it could have been actually some man in the middle, you simply don't know.
Or is it smart to create a SSLSocket?
Much better. This is using an established standard where lots of experts had a closer look at. Don't run your own crypto.
I honestly have no idea how the authentication with the certificats work ...
So you think you are better at designing something yourself when you don't even have an idea how established secure communication methods work and why specific security related design decisions were made? Unlikely that this will actually result in something secure.
... and I also do not want to have a certificate which needs an update every now and then.
TLS is not actually tied to certificates but it scales much better with publicly issued certificates since it can derive trust relationships from this instead of just blindly hoping that no attacker is there when exchanging the key as you do.
For comparison just rephrase your question in the context of health: would you recommend to design your own medicine with practically no understanding of how this stuff works or would it be better to rely on established methods even if they require that you visit the doctor from time to time?
