Decryption is a property of the DTLS session, not of the trace backend. Once the device is built with the developer security tag, provisioned, and producing decodable traces locally, the same traces remain decodable when the device is configured to upload modem traces to Memfault on a coredump.
Combine the developer security tag with the Memfault modem trace overlays, see Memfault Remote Debugging.
Thingy:91 X
west build -p -b thingy91x/nrf9151/ns --sysbuild -- \
-DEXTRA_CONF_FILE="overlay-upload-modem-traces-to-memfault.conf" \
-DEXTRA_DTC_OVERLAY_FILE="overlay-upload-modem-traces-to-memfault.overlay" \
-DCONFIG_NRF_CLOUD_COAP_SEC_TAG=2147483667 \
-DCONFIG_NRF_CLOUD_COAP_JWT_SEC_TAG=16842753 \
&& west flash --recover
nRF9151 DK
west build -p -b nrf9151dk/nrf9151/ns --sysbuild -- \
-DEXTRA_CONF_FILE="overlay-upload-modem-traces-to-memfault.conf" \
-DEXTRA_DTC_OVERLAY_FILE="overlay-upload-modem-traces-to-memfault.overlay" \
-DCONFIG_NRF_CLOUD_COAP_SEC_TAG=2147483667 \
-DCONFIG_NRF_CLOUD_COAP_JWT_SEC_TAG=16842753 \
&& west flash --recover
Download the trace from the device timeline in Memfault, convert it with nRF Util or the Cellular Monitor app, and open it in Wireshark. The Decrypted TLS layer is present exactly as it is for a live capture:
nrfutil trace lte --input-file memfault-modem-trace.bin --output-pcapng memfault-trace.pcapng
This makes it possible to inspect the nRF Cloud CoAP exchange leading up to a crash on a device that is not attached to a debugger.