I created a new Web application using Central Admin in a farm with an existing, functional web app. The web app is pretty basic: blank host header, ssl, other settings using defaults.
After creating a site collection using the team site template, browsing the page gives a message of the server "is currently unable to handle this request". The SharePoint ULS log has "Claims Windows Sign-In: Sending 401 for request '' because the user is not authenticated and resource requires authentication." The IIS logs show 401.0. After turning off friendly http error messages, the page is simply blank.
I do not get prompted for authentication, and the behavior is the same when browsing from both the server and a client machine.
As far as I can tell, the new web app has the same authentication settings as the existing, working web apps. Any suggestions on where to look?
SharePoint 2016, on-prem.