It works!

--8<---------------cut here---------------start------------->8---
guix environment -C -N --expose=/etc/machine-id --expose=/etc/ssl/certs/ \
  --share=$HOME/.local/share/eolie/=$HOME/.local/share/eolie/ \
  --ad-hoc dbus eolie coreutils nss-certs -- \
  env DISPLAY=$DISPLAY eolie
--8<---------------cut here---------------end--------------->8---

Note that the "--expose=/etc/ssl/certs/" is important.

Should we consider this a bug?  If not, then should we document
it?

Maybe this could be automated a bit.

--8<---------------cut here---------------start------------->8---
guix size webkitgtk glib-networking
--8<---------------cut here---------------end--------------->8---

does not return nss-certs.  So if we made nss-certs an input of
webkitgtk (or glib-networking?), we would not need nss-certs in the guix
environment invocation.

Finally, I'm not sure how to fix the /etc/ssl/certs issue.  Why do we
have to put it under /etc/ in the first place?

-- 
Pierre Neidhardt
https://ambrevar.xyz/