private void doGenCRL(PrintStream out)
           throws Exception {
       if (ids == null) { // <--- this condition is always false
           throw new Exception("Must provide -id when -gencrl");
       }

...because it is always initialized to non-null, but empty list:

   private final List<String> ids = new ArrayList<>(); // used in GENCRL

If there is no -id, an empty CRL will be generated. A CRL can be empty, which means no new certs have been revoked since last update.