In section A.1 in the latest 1114 draft:
There is also some
ambiguity in X.509 with regard to the representation of a signed
value, e.g., a certificate signature. The interpretation selected in
PEM requires that the data to be signed is first ASN.1 encoded as an
OCTET STRING and the result is encrypted to form the signed quantity,
which is then ASN.1 encoded as an OCTET STRING.
The method of formatting the signature block for encryption with a
private key belongs in RFC 1115 where the algorithms are defined,
especially since the technique described above is incompatible with
the md2WithRSAEncryption signature algorithm defined there.
- Jeff