I'm trying to implement a simple licensing system for my softwares and there's something I don't quite understand regarding certificates.
I'm using OpenSSL to generate a RSA private and public key. My executables will embed the public key in order to be able to negotiate a secure connection with the server (by exchanging a symmetric key). RSA is limited to the bytes of the key, therefore I will have to deal, for a 2048 key, to send a symmetric key of about 256 bytes (is this correct?)
What I don't understand is the role of certificates in this process.. do I need one? Examples like this one make use of certificates (either signed by a CA or not). Can't my application just connect to my server, send the RSA encrypted symmetric key and start exchanging data? What's the problem with my approach?