The first blast happened as Sunday Mass was being celebrated at the church on Jolo island, where Islamist militants are active.
As soldiers responded, a second device was detonated in the car park.
The attack comes days after a majority-Muslim area in the region voted for greater autonomy in a referendum.
No group has so far said it was behind the attack. Jolo has long been a base for militants including those of the Abu Sayyaf group.
- Who are the Abu Sayyaf group?
- Philippines country profile
What is known about the attack?
The local officials say the first blast happened at 08:45 local time (00:45 GMT) inside the Cathedral of Our Lady of Mount Carmel, which has been hit by bombs in the past.
The second explosion was shortly afterwards on the doorstep of the church.
Local police initially put the death toll at 27 but later lowered it to 20, saying there was double counting in earlier official reports.
Images posted on social media showed the main road leading to the church sealed off by soldiers in armoured personnel carriers.
Some of the wounded were evacuated by air to the nearby city of Zamboanga.
Calling the attack a “dastardly act”, Defence Secretary Delfin Lorenzana urged the local population to work with the authorities to “deny terrorism any victory”.
“We will use the full force of the law to bring to justice the perpetrators behind this incident.”
In last week’s referendum, voters approved the creation of the Bangsamoro Autonomous Region in majority-Muslim areas of southern Philippines.
But voters in Sulu province, where Jolo is located, rejected it.
The referendum was the result of a peace deal between the government and the Moro Islamic Liberation Front (MILF).
The authorities have previously expressed hopes that the vote could be a political solution to try to end decades of fighting between Islamist separatists and the Philippine army in the predominantly Catholic country.
Source: BBC News