When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer?
I explored the source code of libnettle, especially method
rsa_pss_sha256_verify_digest and found that salt which is used inside is 32 similar bytes - 0x22. Using this value I was able to generate a valid signature myself. But I found no information about the salt in any documentation. How is it actually generated for TLS 1.3 CertificateVerify message? Is this value fixed or depends on certificate or key...?