The Apple Technical Note TN2407 has a section titled “Submitting your app for publishing to TestFlight” and in this section Apple says:
TestFlight apps submitted to iTunesConnect need to be signed with an App Store Distribution Profile. TestFlight no longer accepts apps submitted with an Ad Hoc profile.
So the situation is now unambiguous: you need a production certificate for the app, and an App Store distribution provisioning profile.