A small quotation from this wikipedia entry: http://en.wikipedia.org/wiki/MD5

In an attack on MD5 published in December 2008, a group of researchers used this technique to fake SSL certificate validity.[7][8] US-CERT of the U. S. Department of Homeland Security said MD5 "should be considered cryptographically broken and unsuitable for further use,"[9] and most U.S. government applications will be required to move to the SHA-2 family of hash functions after 2010