private byte[] emsaPssEncode(byte[] m, int emBits) throws GeneralSecurityException {
    // Step 1. Length checking.
    // This step is unnecessary because Java's byte[] only supports up to 2^31 -1 bytes while the
    // input limitation for the hash function is far larger (2^61 - 1 for SHA-1).

    // Step 2. Compute hash.
    Validators.validateSignatureHash(sigHash);
    MessageDigest digest =
        EngineFactory.MESSAGE_DIGEST.getInstance(SubtleUtil.toDigestAlgo(this.sigHash));
    byte[] mHash = digest.digest(m);

    // Step 3. Check emLen.
    int hLen = digest.getDigestLength();
    int emLen = (emBits - 1) / 8 + 1;
    if (emLen < hLen + this.saltLength + 2) {
      throw new GeneralSecurityException("encoding error");
    }

    // Step 4. Generate random salt.
    byte[] salt = Random.randBytes(this.saltLength);

    // Step 5. Compute M'.
    byte[] mPrime = new byte[8 + hLen + this.saltLength];
    System.arraycopy(mHash, 0, mPrime, 8, hLen);
    System.arraycopy(salt, 0, mPrime, 8 + hLen, salt.length);

    // Step 6. Compute H.
    byte[] h = digest.digest(mPrime);

    // Step 7, 8. Generate DB.
    byte[] db = new byte[emLen - hLen - 1];
    db[emLen - this.saltLength - hLen - 2] = (byte) 0x01;
    System.arraycopy(salt, 0, db, emLen - this.saltLength - hLen - 1, salt.length);

    // Step 9. Compute dbMask.
    byte[] dbMask = SubtleUtil.mgf1(h, emLen - hLen - 1, this.mgf1Hash);

    // Step 10. Compute maskedDb.
    byte[] maskedDb = new byte[emLen - hLen - 1];
    for (int i = 0; i < maskedDb.length; i++) {
      maskedDb[i] = (byte) (db[i] ^ dbMask[i]);
    }

    // Step 11. Set the leftmost 8 * emLen - emBits bits of the leftmost octet in maskedDB to zero.
    for (int i = 0; i < (long) emLen * 8 - emBits; i++) {
      int bytePos = i / 8;
      int bitPos = 7 - i % 8;
      maskedDb[bytePos] = (byte) (maskedDb[bytePos] & ~(1 << bitPos));
    }

    // Step 12. Generate EM.
    byte[] em = new byte[maskedDb.length + hLen + 1];
    System.arraycopy(maskedDb, 0, em, 0, maskedDb.length);
    System.arraycopy(h, 0, em, maskedDb.length, h.length);
    em[maskedDb.length + hLen] = (byte) 0xbc;
    return em;
  }
RsaSsaPss (i.e. RSA Signature Schemes with Appendix (SSA) with PSS encoding) signing with JCE.
java_src/src/main/java/com/google/crypto/tink/subtle/RsaSsaPssSignJce.java