Q:

Role of certificates in simple hybrid cryptosystem

I'm trying to implement a simple licensing system for my softwares and there's something I don't quite understand regarding certificates.
I'm using OpenSSL to generate a RSA private and public key. My executables will embed the public key in order to be able to negotiate a secure connection with the server (by exchanging a symmetric key). RSA is limited to the bytes of the key, therefore I will have to deal, for a 2048 key, to send a symmetric key of about 256 bytes (is this correct?)
What I don't understand is the role of certificates in this process.. do I need one? Examples like this one make use of certificates (either signed by a CA or not). Can't my application just connect to my server, send the RSA encrypted symmetric key and start exchanging data? What's the problem with my approach?

A:

What I don't understand is the role of certificates in this process..

you already answered your question:

Can't my application just connect to my server

only if your application would know that it is your server and not mine... Here is where certificates start to play a role. They are used to identify communication peers. Server identifies itself with server certificate and client identifies itself with client certificate (if necessary).
All certificates are very similar and you must be able to distinguish them before trusting them. This means that client application must use some logic to validate server certificate to determine whether it is the right and trusted one. There are various options, one of which includes Certificate Pinning. While it sounds as an easy solution, it has some serious issues when you have to replace server certificate, because of expiration or because of compromise.

