As you mentioned that the list of certificates in your org is empty, it is because you are checking a different org than what is mentioned in the automated email received.
Additional info adding to sfdcfox's answer:
The reason you have received the email was that, if any certificate was to expire in the upcoming days/months, Salesforce has an inbuilt functionality that sends certificate expiry notifications at 60-day mark, 30-day mark,10-day mark, and day of expiry.
You should be able to see the delete option for the expired certificates in your org. Usually, the Delete button will be grayed out if certificate is in use somewhere. You'll have to remove its usage before for being able to see the delete button.
Similar post from the past: Do I need to renew the default SelfSignedCert that I never created?
Recommended checks to identify if the expired certificate is being used:
1.Single Sign-On settings -Check your Single sign-on setting(from the setup menu) and see that you are not using the certificate over
2.Identity Provider Settings - If you are using this certificate, logs would be generated in the "Identity Provider Event Log"
3.Connected app - Open the connected app and see if the certificate is provided as any IDP certificate
4.Web service callout - You need to find out if you are using this certificate within your Integration as a client certificate; if yes,
then you need to share this updated certificate with your Server(3rd
party integration) team so that they can replace the old certificate
with the new one. Your Integration team(or Developers) would know
more details on this.
5.In the certificate and key management settings, check if the certificate is listed under "API client certificate".If yes, it is being used in your code somewhere.