SSL over self-implemantation of RSA?

I currently write a client application which communicates with a PHP server.

The application itself requires valid user credentials and get all of his information by doing POST requests to the PHP server. Is the first scenario safe or should I use SSL/TLS instead?

1st scenario (already implemented):

• Client application has a hardcoded RSA public key


• Application generates a random AES key and IV on each start. (Never uses the same key and IV to encrypt the username and password)


• Client application encrypts the AES key and IV with RSA public key in a string


• PHP server decrypts the string and stores the AES key and IV


• Client application encrypts the username and password when trying to login


• PHP server receives the encrypted data, decrypts the data and uses password_verify to see if login credentials match which the stored ones


• After successful login the client application needs some user data and request a nonce from the PHP server using the encrypted username and password


• The PHP server encrypts the nonce and sends it to the client application


• The client application decrypts the nonce and sends it with the POST request


• PHP server takes a look in the database and sees that the nonce is valid


• PHP server sends the AES encrypted data the user asked for


• The client application now decrypts the data

2nd scenario:

• Implementing mutual ssl authentication