As to the specs, note that [4.7](https://www.rfc-editor.org/rfc/rfc5246#section-4.7) says In RSA signing, the opaque vector contains the signature generated using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ... referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation. Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is in brief $$\operatorname{modexp}(n,d) (\operatorname{add01FF...00} (\operatorname{DERSEQ} (\operatorname{hash}(M)))))$$ while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$\operatorname{modexp}(n,d) (\operatorname{maybe\_add01FF...00} (\operatorname{SHA1concatMD5}(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead. Meta: Mathjax _somewhat_ better, thanks SEJPM.