Hi,
Based on my understanding, event ID's will be generated before the expiry. So task scheduler can be created based on that event ID and send email notifications
https://social.technet.microsoft.com/wiki/contents/articles/14250.certificate-services-lifecycle-notifications.aspx
https://social.technet.microsoft.com/Forums/en-US/dec6ea30-b53d-42c8-8136-885afcc10f1c/certificate-autority-notifications?forum=winserversecurity
If the above suggestion helps, please click on "Accept Answer" and upvote it