MD5 crack for digital certificates

["M.D.Mufambisi" <mufambisi () gmail com>]

Hi people.

I have been reading about the recent crack on digital certificates
signed using MD5 hashing algorithm. I am a bit confused by the concept
and i request clarification from anyone who understands it. From my
understanding, this is what happens when a certificate is created:

1. Message hash computed (in this instance using MD5)
2. Message hash encrypted with CA private key.
3. Message hash appended to certificate.

How then are they "cracking" md5? when there is the encryption done on
the hash? Im quite hazy on this one.

Also, just another one with regards to bruteforce attacks, how does a
brute force attacker (application) know it has reached the correct
password? Because to it, they are just characters right? is there a
flag set by the application being cracked to say "alright, stop, you
got the right one there?"

thanks.