SHA256 Signing with RSA PSS padding

You can try to do it using the OpenSSL libraries, which comes complete with Caché/Ensemble/etc.
To google: "openssl rsa-pss sign", "openssl SHA256 with RSA PSS padding"

Here is a small example on Windows, where it is assumed that

• cert.pem is your certificate:

  -----BEGIN CERTIFICATE-----
  <...>
  -----END CERTIFICATE-----

• key.pem is your private key:
  

  -----BEGIN RSA PRIVATE KEY-----
  <...>
  -----END RSA PRIVATE KEY-----

So (test.bat):

@echo off
 
echo Delete all temporary files
del /Q /F test.txt test.sig pubkey.pem test.b64
 
echo Extract the public key from certificate (only be done once)
openssl x509 -pubkey -in cert.pem -noout > pubkey.pem
 
echo Create test file (test.txt)
echo bla-bla-bla test123 {Date}{newline}{Password}{newline}{etc}{Message Body} > test.txt
 
echo Create signature (test.sig)
openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -sign key.pem -out test.sig test.txt
 
echo This step is only for information/verification.
echo Verify signature (The result should be: "Verified OK")
openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -signature test.sig -verify pubkey.pem test.txt
 
echo Convert signature to Base64 (test.b64)
echo You can this step be make on COS.
openssl base64 -in test.sig -out test.b64 -nopad

Or on COS:

#include %systemInclude
#include %occErrors
main() public {
  
  s fileMsg="test.txt",
    fileSig="test.sig",
    file64="test.b64",
    filePubKey="pubkey.pem",
    fileCert="C:\SSL\cert.pem",
    fileKey="C:\SSL\key.pem"

  try {
    $$$AddAllRoleTemporaryInTry
    n $namespace


    if '##class(%File).Exists(filePubKey) {
      ; Only be done once
      ; Extract the public key from certificate
      s cmd=$$$FormatText("openssl x509 -pubkey -in %1 -noout > %2",fileCert,filePubKey)
      w cmd,!!
      d $zf(-1,cmd)
    }
    
    f i=fileMsg,fileSig,file64 d ##class(%File).Delete(i)
    
    s file=##class(%Stream.FileCharacter).%New()
    s file.Filename=fileMsg
    s file.TranslateTable="UTF8"
    d file.WriteLine("{Date}")
    d file.WriteLine("{Password}")
    d file.Write("{etc}{Message Body}")
    $$$ThrowOnError(file.%Save())
    
    w $$$FormatText("Create signature (%1)",fileSig),!
    s cmd=$$$FormatText("openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -sign %1 -out %2 %3",fileKey,fileSig,fileMsg)
    w cmd,!!
    d $zf(-1,cmd)
    
    w $$$FormatText("Convert signature to Base64 (%1)",file64),!
    s cmd=$$$FormatText("openssl base64 -in %1 -out %2 -nopad",fileSig,file64)
    w cmd,!!
    d $zf(-1,cmd)
    
    ;here we read our file test.b64 (file64) and place it in a Signature field in the header
    
  }catch(ex) {
    w "Error ", ex.DisplayString(),!
  }

  f i=fileMsg,fileSig d ##class(%File).Delete(i)
}