A method for updating a certificate issuer public key includes receiving, by an eUICC, first information sent by a LPA, where the first information includes a first CI public key identifier, and the first CI public key identifier is a CI public key identifier that the eUICC does not have. The method further includes sending, by the eUICC, second information to an OPS by using the LPA, where the second information includes the first CI public key identifier. The method further includes receiving, by the eUICC, a patch package sent by the OPS by using the LPA, where the patch package includes at least a first CI public key corresponding to the first CI public key identifier. The method further includes updating, by the eUICC, a CI public key of the eUICC by using the first CI public key.