As to the specs, note that [4.7](https://tools.ietf.org/html/rfc5246#section-4.7) says In RSA signing, the opaque vector contains the signature generated using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ... referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation. Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is $$modexp(n,d) (add01FF...00 (DERSEQOIDandOCTSTRING (hash(M)))))$$ while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$modexp(n,d) (add01FF...00or1.0addnothing (SHA1concatMD5(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead. Meta: yes my Mathjax is ugly; anyone who knows how to improve it feel free.