A method includes: receiving, by an embedded universal integrated circuit card eUICC, first information sent by a local profile assistant LPA, where the first information includes a first certificate issuer CI public key identifier, and the first CI public key identifier is a CI public key identifier that the eUICC does not have; sending, by the eUICC, second information to an OPS by using the LPA, where the second information includes the first CI public key identifier; receiving, by the eUICC, a patch package sent by the OPS by using the LPA, where the patch package includes at least a first CI public key corresponding to the first CI public key identifier; and updating, by the eUICC, a CI public key of the eUICC by using the first CI public key.