Based on the information you have its unclear if something malicious is really going on. Certificates are used on websites running the HTTPS protocol to verify the server's identity and provide encryption. While it is possible that this is a spoofed email, or that the sender's account has been hacked, it's also possible this is a valid link and the web server is simply misconfigured (e.g. the certificate expired and the web server was not updated). The best way to proceed is to forward the email to whomever is responsible for IT Security at the company so the details can be determined in an investigation.