The radical Islamist, who had wanted to fight with the Islamic State group in Syria, injured four people.
National police spokesman Setyo Wasisto announced that police fatally shot four suspected militants and arrested two others early ON Sunday in West Java.
The first explosion took place at Santa Maria Tak Bercela Church.
Churches in other cities, such as in Bandung, were guarded by police during mass.
Last May, two suicide bombers attacked a bus station in Indonesia's capital Jakarta, killing at least three police officers and wounding six officers and five civilians, with authorities suspecting ISIS involvement.
In 2000 bombs disguised as Christmas gifts delivered to churches and clergymen killed 19 people on Christmas Eve and injured scores more across the country. The Islamic State group claimed responsibility.
More than 90% of Indonesians are Muslim, but there are also significant populations of Christians, Hindus and Buddhists.More news: Dyer: Trump's irrational action with Iran may hasten war
More news: Andres Iniesta gets unique farewell gift from Villarreal
More news: Iran says Syria has every right to defend itself against Israel
The detonations ocurred within 10 minutes of each other.
The U.S. State Department designated JAD as a terrorist group in January 2017. A large blast was heard hours after the attacks, which Mangera said was a bomb disposal squad "securing" a remaining device.
Police ordered the temporary closure of all churches in Surabaya on Sunday, and a large food festival in the city was cancelled.
- May 2018: Five police officers and a prisoner are killed in clashes at a high-security jail that saw Islamist inmates take an officer hostage.
A sustained crackdown weakened the most risky networks but the emergence of IS has proved a potent new rallying cry for radicals.
Investigators are on the alert, saying that the organization may be planning more attacks. But former National Counterterrorism Agency (BNPT) chief Ansyaad Mbai said the bombings in Surabaya could be linked to the riot that occurred at a detention center at the National Police's Mobile Brigade headquarters (Mako Brimob) in Depok, West Java.