Consider the following scenario:
- client sends hello
- server send a hello and its certificate
- client generates a key and encrypts that with server's public key
- server decrypts the key with its private key
So, they shared a key and can talk with each other.
What is the problem with this? Why does SSL require that the client and server both generate a random for the session?