TLS: Risks of using a NULL cipher with encryption implemented in application?
The problem is that the session keys within TLS are bound to the TLS session. If you just generate your own keys then that particular binding is lost. You might be able to hack or retrieve information from the TLS session to bind it again, but that would be rather like hacking.

Establishing the keys yourself will very likely lead to a significantly worse protocol than using TLS itself; you'll be bound to make all mistakes in SSL 1.0 to TLS 1.2 all over again.

Instead I propose that you keep to the current TLS to the server. However, that TLS session itself can be tunneled though a much more secure TLS session, possibly using an intermediate node on the server side. Some networking tricks may be necessary of course (e.g. to allow for reverse DNS checking by the original server).