When the forged certificate was created MD5 has been _throughly_ broken for a long time, much more so than SHA-1 even now.