I am quite aware of that paper (quite some time before they released it to the public even, check the locations where they actually did the calculations and you would understand why ;) As for the Cert, 00:9C:21 (2010-01-26 = 2012-01-26) is SHA-1 signed and has both an MD5+SHA1 fingerprint, the Certificate Signature Algorithm: "PKCS #1 SHA-1 With RSA Encryption" thus nothing strange there. Note that the CACert Class 3 certificate indeed uses MD5, but CACert don't have a solution for that yet. Nevertheless, I wonder why you throw this on the forum btw, instead of mailing info@sixxs.net if you think it is a security issue in the first place.