See response from Apple engineer here:

https://forums.developer.apple.com/forums/thread/663451

The first one (Sanbox) is the old certificate for development builds, and is there for legacy purposes. The new certificate (Sandbox & Production) can be used for both development and production entitlements.