Poor man's SSL - is this method as safe as SSL/TLS?
TLS not only provides privacy, but also authentication:


You can be sure you know who you speak to (at least the client knows if the server was using a certificate). (You provide this by the "HTTPS key exchange" you are doing at the start.)
You can be sure that you speak to the same entity at the other side throughout the whole live of your connection (even if you don't know who this is, e.g. as a server with non-authenticated client).
You can be sure that you get exactly what the other side sent, not something modified by someone between both sides.


AES (or any other block cipher) in a streaming mode (like CBC, CFB, OFB, CTR, ...) doesn't provide this guarantee. Because of this, there are various attacks at these modes which also endanger your privacy.

So make sure you are either


using a mode of operation which also includes authentication (look for "AEAD") or
using a normal privacy mode together with an external MAC (like HMAC) - and transfer the MAC key together with the encryption key during your key exchange).