From the standard, one would assume that passwords for PKCS#12 files could have arbitrary length. For some reason though, Microsoft seems to think that 31 characters should be enough for everyone (although it has a password input box with a length of 32 characters). So we reduced the length of our random passwords to 31, now it turns out Lotus Notes/Domino can only accept even shorter passwords — up to 30 characters — d'oh!